serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization

🗓️ 27 May 2026 10:03:49Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 18 Views

This vulnerability in serialize-javascript allows a crafted array-like object with length to cause DoS.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: Vulnerability in Serialize JavaScript affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in serialize-javascript bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging	13 Jul 202621:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	27 May 202615:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	12 Jun 202611:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Aspera Faspex	16 Apr 202622:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service (CVE-2026-34043)	13 Apr 202610:06	–	ibm
ATTACKERKB	CVE-2026-34043	31 Mar 202601:48	–	attackerkb
Tenable Nessus	AlmaLinux 10 : .NET 8.0 (ALSA-2026:21286)	28 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : .NET 8.0 (ALSA-2026:21291)	28 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : .NET 8.0 (ALSA-2026:21293)	28 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.8	aarch64	aspnetcore-runtime-8.0	8.0.27-1.el9_8	aspnetcore-runtime-8.0-8.0.27-1.el9_8.aarch64.rpm
Red Hat Enterprise Linux	9.8	ppc64le	aspnetcore-runtime-8.0	8.0.27-1.el9_8	aspnetcore-runtime-8.0-8.0.27-1.el9_8.ppc64le.rpm
Red Hat Enterprise Linux	9.8	s390x	aspnetcore-runtime-8.0	8.0.27-1.el9_8	aspnetcore-runtime-8.0-8.0.27-1.el9_8.s390x.rpm
Red Hat Enterprise Linux	9.8	x86_64	aspnetcore-runtime-8.0	8.0.27-1.el9_8	aspnetcore-runtime-8.0-8.0.27-1.el9_8.x86_64.rpm
Red Hat Enterprise Linux	9.8	aarch64	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_8	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_8.aarch64.rpm
Red Hat Enterprise Linux	9.8	ppc64le	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_8	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_8.ppc64le.rpm
Red Hat Enterprise Linux	9.8	s390x	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_8	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_8.s390x.rpm
Red Hat Enterprise Linux	9.8	x86_64	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_8	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_8.x86_64.rpm
Red Hat Enterprise Linux	9.8	aarch64	aspnetcore-targeting-pack-8.0	8.0.27-1.el9_8	aspnetcore-targeting-pack-8.0-8.0.27-1.el9_8.aarch64.rpm
Red Hat Enterprise Linux	9.8	ppc64le	aspnetcore-targeting-pack-8.0	8.0.27-1.el9_8	aspnetcore-targeting-pack-8.0-8.0.27-1.el9_8.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-34043
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b
github	www.github.com/yahoo/serialize-javascript/releases/tag/v7.0.5
github	www.github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34043
cve	www.cve.org/CVERecord

27 Jul 2026 22:29Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.15.9 - 7.5

EPSS0.00472

SSVC

serialize-javascript array like large length denial of service vulnerability processor load