ChangeIntel IT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Sources need attention Customize Public modeDiscuss ChangeIntel on Discord
GHSA-qj8w-gfj5-8c6vPublished

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

View advisory data (JSON)

Exploitation and risk

Source status

CISA KEV lists vulnerabilities known to be exploited. FIRST EPSS estimates the likelihood of exploitation in the next 30 days. An unavailable score does not mean zero risk.

Which CVEs have scores here?

This view includes predictions for CVE identifiers explicitly listed in public NuGet advisories. Microsoft release pages have their own prediction coverage. Check source status for the scope and latest checks.

No exploitation or prediction data is available here for these CVEs. This does not mean they are safe or unlikely to be exploited.

cve-program · CVE-2026-34043

Published

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

Source published
31 Mar 2026 01:48:45 UTC
Source modified
31 Mar 2026 13:55:54 UTC
Saved here
23 Oct 2026 15:48:27 UTC
Source terms
CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

euvd · EUVD-2026-17288

Published

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

Additional publisher context

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Mar 31, 2026, 1:48:45 AM

dateUpdated: Mar 31, 2026, 1:55:54 PM

17 related source bulletins · separate from aliases

WID-SEC-W-2026-3046: IBM Concert: Mehrere Schwachstellen

CVE-2019-19921 · CVE-2021-23337 · CVE-2024-3651 · CVE-2024-39338 · CVE-2024-45590 · CVE-2025-13465 · CVE-2025-15284 · CVE-2025-15599 · CVE-2025-22874 · CVE-2025-47273 · CVE-2025-47907 · CVE-2025-52881 · CVE-2025-53643 · CVE-2025-55184 · CVE-2025-58056 · CVE-2025-58188 · CVE-2025-58189 · CVE-2025-61723 · CVE-2025-61730 · CVE-2025-64649 · CVE-2025-64756 · CVE-2025-67221 · CVE-2025-68121 · CVE-2025-68146 · CVE-2026-0540 · CVE-2026-2327 · CVE-2026-23490 · CVE-2026-23897 · CVE-2026-2391 · CVE-2026-23949 · CVE-2026-24486 · CVE-2026-25528 · CVE-2026-25547 · CVE-2026-25639 · CVE-2026-25990 · CVE-2026-26007 · CVE-2026-26019 · CVE-2026-26996 · CVE-2026-27142 · CVE-2026-27212 · CVE-2026-27699 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-28684 · CVE-2026-29063 · CVE-2026-29181 · CVE-2026-2950 · CVE-2026-31808 · CVE-2026-31900 · CVE-2026-32274 · CVE-2026-32288 · CVE-2026-32597 · CVE-2026-32630 · CVE-2026-32887 · CVE-2026-32952 · CVE-2026-33186 · CVE-2026-33532 · CVE-2026-33750 · CVE-2026-33814 · CVE-2026-33816 · CVE-2026-33916 · CVE-2026-34043 · CVE-2026-34073 · CVE-2026-34077 · CVE-2026-3520 · CVE-2026-35469 · CVE-2026-35515 · CVE-2026-3627 · CVE-2026-39823 · CVE-2026-39825 · CVE-2026-39826 · CVE-2026-39892 · CVE-2026-39984 · CVE-2026-40175 · CVE-2026-40179 · CVE-2026-40181 · CVE-2026-40190 · CVE-2026-40347 · CVE-2026-41066 · CVE-2026-41182 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-41324 · CVE-2026-41425 · CVE-2026-41481 · CVE-2026-41488 · CVE-2026-41602 · CVE-2026-41636 · CVE-2026-42151 · CVE-2026-42154 · CVE-2026-42198 · CVE-2026-42211 · CVE-2026-42338 · CVE-2026-42342 · CVE-2026-42561 · CVE-2026-42577 · CVE-2026-43870 · CVE-2026-44405 · CVE-2026-44431 · CVE-2026-44432 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44496 · CVE-2026-44728 · CVE-2026-4539 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-4800 · CVE-2026-4923 · CVE-2026-4926 · CVE-2026-7246 · CVE-2026-8723

WID-SEC-W-2026-2460: Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen

CVE-2016-10540 · CVE-2020-28282 · CVE-2020-7729 · CVE-2021-22569 · CVE-2021-23358 · CVE-2022-1537 · CVE-2022-3509 · CVE-2022-3510 · CVE-2022-37599 · CVE-2022-37601 · CVE-2022-37603 · CVE-2024-7254 · CVE-2025-11226 · CVE-2025-14813 · CVE-2025-62718 · CVE-2025-69873 · CVE-2026-12143 · CVE-2026-21575 · CVE-2026-21577 · CVE-2026-21579 · CVE-2026-22731 · CVE-2026-2332 · CVE-2026-27830 · CVE-2026-29063 · CVE-2026-29145 · CVE-2026-29146 · CVE-2026-31802 · CVE-2026-33671 · CVE-2026-33870 · CVE-2026-33871 · CVE-2026-34043 · CVE-2026-35554 · CVE-2026-40175 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42041 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-42198 · CVE-2026-42264 · CVE-2026-42581 · CVE-2026-42583 · CVE-2026-42585 · CVE-2026-42587 · CVE-2026-42588 · CVE-2026-44249 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44490 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496 · CVE-2026-44705 · CVE-2026-45416 · CVE-2026-45505 · CVE-2026-45736 · CVE-2026-46625 · CVE-2026-47838 · CVE-2026-4800 · CVE-2026-48043 · CVE-2026-48779 · CVE-2026-50010 · CVE-2026-5598 · CVE-2026-6321 · CVE-2026-6322

msrc_CVE-2026-34043: Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

CVE-2026-34043

RHSA-2026:17474: Red Hat Security Advisory: OpenShift Container Platform 4.21.16 bug fix and security update

CVE-2026-22029 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-40175 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043

RHSA-2026:17468: Red Hat Security Advisory: OpenShift Container Platform 4.20.23 bug fix and security update

CVE-2025-61726 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40175 · CVE-2026-42033 · CVE-2026-42035 · CVE-2026-42039 · CVE-2026-42041 · CVE-2026-42043

RHSA-2026:34099: Red Hat Security Advisory: OpenShift Container Platform 4.17.55 bug fix and security update

CVE-2026-27140 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469

WID-SEC-W-2026-1058: IBM App Connect Enterprise: Schwachstelle ermöglicht Denial of Service

CVE-2026-34043

RHSA-2026:17448: Red Hat Security Advisory: OpenShift Container Platform 4.18.42 bug fix and security update

CVE-2026-4800 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986

RHSA-2026:56431: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update

CVE-2025-61726 · CVE-2025-61729 · CVE-2025-64718 · CVE-2025-68470 · CVE-2026-1525 · CVE-2026-1526 · CVE-2026-1527 · CVE-2026-2229 · CVE-2026-6321 · CVE-2026-6322 · CVE-2026-6733 · CVE-2026-6734 · CVE-2026-9358 · CVE-2026-9679 · CVE-2026-9697 · CVE-2026-11525 · CVE-2026-12143 · CVE-2026-12151 · CVE-2026-13149 · CVE-2026-13676 · CVE-2026-22036 · CVE-2026-25645 · CVE-2026-33186 · CVE-2026-33349 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33750 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-39821 · CVE-2026-40181 · CVE-2026-41305 · CVE-2026-41650 · CVE-2026-41907 · CVE-2026-42342 · CVE-2026-45409 · CVE-2026-45736 · CVE-2026-48779 · CVE-2026-48801 · CVE-2026-53550 · CVE-2026-59869

RHSA-2026:21293: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

RHSA-2026:21291: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

RHSA-2026:24334: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

RHSA-2026:24332: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

RHSA-2026:24335: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

RHSA-2026:29082: Red Hat Security Advisory: OpenShift Container Platform 4.16.65 bug fix and security update

CVE-2026-33186 · CVE-2026-34043 · CVE-2026-44486 · CVE-2026-44487 · CVE-2026-44488 · CVE-2026-44492 · CVE-2026-44494 · CVE-2026-44495 · CVE-2026-44496

RHSA-2026:20041: Red Hat Security Advisory: OpenShift Container Platform 4.19.32 bug fix and security update

CVE-2025-12816 · CVE-2025-61726 · CVE-2025-66031 · CVE-2026-4800 · CVE-2026-22029 · CVE-2026-25679 · CVE-2026-27143 · CVE-2026-27144 · CVE-2026-29063 · CVE-2026-33186 · CVE-2026-34043 · CVE-2026-34986 · CVE-2026-35469 · CVE-2026-40175

RHSA-2026:21286: Red Hat Security Advisory: .NET 8.0 security update

CVE-2026-34043 · CVE-2026-42899

Source published
Mar 31, 2026, 1:48:45 AM (timezone not stated)
Source modified
Mar 31, 2026, 1:55:54 PM (timezone not stated)
Saved here
15 Nov 2026 10:06:26 UTC
Source terms
ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

Source: euvd · ENISA EUVD · source terms and attribution apply. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

EUVD CVSS 3.1 · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

nvd · CVE-2026-34043

Published

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

Additional publisher context

NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.

Source analysis status: Analyzed

Weakness classifications: CWE-400 · CWE-834

Original publisher date fields

published: 2026-03-31T03:15:58.400

lastModified: 2026-06-17T10:38:28.740

1 source CPE criteria · context only
  • cpe:2.3:a:yahoo:serialize:*:*:*:*:*:*:*:*

The original JSON retains the logical configuration operators, exclusions and version bounds.

Source published
31 Mar 2026 03:15:58 UTC
Source modified
17 Jun 2026 10:38:28 UTC
Saved here
25 Oct 2026 08:17:29 UTC
Source terms
NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

Source: nvd · NIST NVD usage terms; underlying source attribution retained. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS 3.1 · [email protected] · Secondary · 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS 3.1 · [email protected] · Primary · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

osv · GHSA-qj8w-gfj5-8c6v

Published

### Impact **What kind of vulnerability is it?** It is a **Denial of Service (DoS)** vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from `Array.prototype` but has a very large `length` property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. **Who is impacted?** Applications that use `serialize-javascript` to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to **Prototype Pollution** or handles untrusted data via **YAML Deserialization**, as these could be used to inject the malicious object. ### Patches **Has the problem been patched?** Yes, the issue has been patched by replacing `instanceof Array` checks with `Array.isArray()` and using `Object.keys()` for sparse array detection. **What versions should users upgrade to?** Users should upgrade to **`v7.0.5`** or later. ### Workarounds **Is there a way for users to fix or remediate the vulnerability without upgrading?** There is no direct code-level workaround within the library itself. However, users can mitigate the risk by: * Validating and sanitizing all input before passing it to the `serialize()` function. * Ensuring the environment is protected against Prototype Pollution. * Upgrading to **`v7.0.5`** as soon as possible. ### Acknowledgements Serialize JavaScript thanks **Tomer Aberbach** (@TomerAberbach) for discovering and privately disclosing this issue.

Source published
27 Mar 2026 18:18:54 UTC
Source modified
10 Sep 2026 03:50:40 UTC
Saved here
24 Oct 2026 13:17:17 UTC
Source terms
GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

Source: osv · GitHub Advisory Database · CC-BY-4.0. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.

CVSS_V3 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Publisher rating · MODERATE

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 15 Nov 11:08 UTC · 256 of 275 readable · 252 fully read · documentation 469/469 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners.