serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization

🗓️ 08 Jun 2026 02:02:50Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 20 Views

serialize-javascript flaw enables DoS via array-like object with large length, causing CPU exhaustion.

Reporter	Title	Published	Views	Family All 91
IBM Security Bulletins	Security Bulletin: Vulnerability in Serialize JavaScript affects IBM watsonx Assistant Cartridge and IBM watsonx Orchestrate with watsonx Assistant Cartridge.	22 Jun 202613:20	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in serialize-javascript bundled with IBM Fusion, IBM Fusion HCI and IBM Fusion Data Cataloging	13 Jul 202621:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Quantum Safe Remediator is affected by mutiple vulnerabilities	27 May 202615:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM watsonx Orchestrate Developer Edition	12 Jun 202611:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Aspera Faspex	16 Apr 202622:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container DesignerAuthoring operands are vulnerable to denial of service (CVE-2026-34043)	13 Apr 202610:06	–	ibm
ATTACKERKB	CVE-2026-34043	31 Mar 202601:48	–	attackerkb
Tenable Nessus	AlmaLinux 10 : .NET 8.0 (ALSA-2026:21286)	28 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 8 : .NET 8.0 (ALSA-2026:21291)	28 May 202600:00	–	nessus
Tenable Nessus	AlmaLinux 9 : .NET 8.0 (ALSA-2026:21293)	28 May 202600:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	9.4	aarch64	aspnetcore-runtime-8.0	8.0.27-1.el9_4	aspnetcore-runtime-8.0-8.0.27-1.el9_4.aarch64.rpm
Red Hat Enterprise Linux	9.4	ppc64le	aspnetcore-runtime-8.0	8.0.27-1.el9_4	aspnetcore-runtime-8.0-8.0.27-1.el9_4.ppc64le.rpm
Red Hat Enterprise Linux	9.4	s390x	aspnetcore-runtime-8.0	8.0.27-1.el9_4	aspnetcore-runtime-8.0-8.0.27-1.el9_4.s390x.rpm
Red Hat Enterprise Linux	9.4	x86_64	aspnetcore-runtime-8.0	8.0.27-1.el9_4	aspnetcore-runtime-8.0-8.0.27-1.el9_4.x86_64.rpm
Red Hat Enterprise Linux	9.4	aarch64	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_4	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_4.aarch64.rpm
Red Hat Enterprise Linux	9.4	ppc64le	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_4	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_4.ppc64le.rpm
Red Hat Enterprise Linux	9.4	s390x	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_4	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_4.s390x.rpm
Red Hat Enterprise Linux	9.4	x86_64	aspnetcore-runtime-dbg-8.0	8.0.27-1.el9_4	aspnetcore-runtime-dbg-8.0-8.0.27-1.el9_4.x86_64.rpm
Red Hat Enterprise Linux	9.4	aarch64	aspnetcore-targeting-pack-8.0	8.0.27-1.el9_4	aspnetcore-targeting-pack-8.0-8.0.27-1.el9_4.aarch64.rpm
Red Hat Enterprise Linux	9.4	ppc64le	aspnetcore-targeting-pack-8.0	8.0.27-1.el9_4	aspnetcore-targeting-pack-8.0-8.0.27-1.el9_4.ppc64le.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2026-34043
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b
github	www.github.com/yahoo/serialize-javascript/releases/tag/v7.0.5
github	www.github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-34043
cve	www.cve.org/CVERecord

20 Jul 2026 18:21Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.9 - 7.5

EPSS0.00472

SSVC

serialize-javascript denial of service array-like object large length cpu exhaustion indefinite hang