CVE-2026-24006

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24006
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 Patch
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*
History

06 Apr 2026, 13:51

Type Values Removed Values Added
Summary
  • (es) Seroval facilita la serialización de valores JS, incluyendo estructuras complejas más allá de las capacidades de JSON.stringify. En las versiones 1.4.0 y anteriores, la serialización de objetos con una profundidad extrema puede exceder el límite máximo de la pila de llamadas. En la versión 1.4.1, Seroval introduce un parámetro 'depthLimit' en los métodos de serialización/deserialización. Se lanzará un error si se alcanza el límite de profundidad.
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:* cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*

27 Feb 2026, 14:44

Type Values Removed Values Added
First Time Lxsmnsyc seroval
Lxsmnsyc
References () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - Patch
References () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx - () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx - Mitigation, Vendor Advisory
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*

22 Jan 2026, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 03:15

Updated : 2026-04-06 13:51

NVD link : CVE-2026-24006

Mitre link : CVE-2026-24006

CVE.ORG link : CVE-2026-24006

JSON object : View

Products Affected

lxsmnsyc

  • seroval
CWE
CWE-770

Allocation of Resources Without Limits or Throttling