Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished. ### Impact A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request. - The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever. ### Patches Fixed in `[email protected]`. - Element lists must be arrays. - A sequence node's throw and done indices must be integers from -1 up to the last element index. Invalid input throws `SerovalMalformedNodeError`. ### Workarounds None. Upgrade to 1.6.8.

Source published

28 Oct 2026 21:17:27 UTC

Source modified

28 Oct 2026 21:30:06 UTC

Observed here

28 Oct 2026 21:55:29 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · HIGH