GHSA-66fc-rw6m-c2q6: Seroval affected by Denial of Service via Array serialization

Skip to content

Navigation Menu

• • AI CODE CREATION

    • GitHub CopilotWrite better code with AI

    • GitHub SparkBuild and deploy intelligent apps

    • GitHub ModelsManage and compare prompts

    • MCP RegistryNewIntegrate external tools

View all features

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2026-23957

Seroval affected by Denial of Service via Array serialization

High severity GitHub Reviewed Published Jan 21, 2026 in lxsmnsyc/seroval • Updated Jan 21, 2026

Package

npm seroval (npm)

Affected versions

<= 1.4.0

Description

Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.

Mitigation:
Seroval no longer encodes array lengths.
Instead, it computes length using Array.prototype.length during deserialization.

References

• GHSA-66fc-rw6m-c2q6
• lxsmnsyc/seroval@ce9408e

Published to the GitHub Advisory Database

Jan 21, 2026

Last updated

Jan 21, 2026

EPSS score