@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +122 more potentially affected by CVE-2026-24006 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-24006 Source advisory:...

GHSA-3J22-8QJ3-26MX Seroval affected by Denial of Service via Deeply Nested Objects

Serialization of objects with extreme depth can exceed the maximum call stack limit. Mitigation: Seroval introduces a depthLimit parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached...

CVE-2026-23957

A flaw was found in seroval. A remote attacker can exploit this vulnerability by providing specially crafted input that overrides encoded array lengths with an excessively large value during the deserialization process. This manipulation causes the application to significantly increase processing...

CVE-2026-23956

A flaw was found in seroval, a JavaScript JS value stringification library. A remote attacker could exploit this vulnerability by providing specially crafted regular expressions during deserialization. This could lead to the exhaustion of JavaScript runtime memory or trigger a Regular Expression...

CVE-2026-23737

A flaw was found in seroval, a JavaScript library designed to convert complex data into a string format. This vulnerability exists within the library's JSON deserialization process, which is responsible for converting string data back into usable objects. A remote attacker can exploit improper...

Allocation of Resources Without Limits or Throttling

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when serializing objects with very large depth. An attacker can cause resource exhaustion and disrupt service availability by submitting objects with...

org.webjars.npm:solid-js (1.9.5) potentially affected by CVE-2026-24006 via org.webjars.npm:seroval (1.2.1)

org.webjars.npm:seroval MAVEN version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:seroval and may be impacted: - org.webjars.npm:solid-js 1.9.5 Source cves: CVE-2026-24006 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-15054528...

@aexol/opencode-tui (>=0.2.5, <=0.2.10), @agent-qofeno/agentx-cli (>=1.20.47, <=1.20.52) +122 more potentially affected by CVE-2026-24006 via seroval (>=1.0.7, <=1.3.2)

seroval NPM version =1.0.7, =0.2.5, =1.20.47, =2.11.0, =1.0.0, =1.0.0, =1.1.54, =1.1.54, =1.0.24, =0.1.0, =0.3.0, =0.3.2 - @entropy-tamer/reynard-config 0.1.2 - @entropy-tamer/reynard-i18n 1.2.0 - @entropy-tamer/reynard-validation 0.2.0 and more Source cves: CVE-2026-24006 Source advisory:...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling when serializing objects with very large depth. An attacker can cause resource exhaustion and disrupt service availability by submitti...

EUVD-2026-4134

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

CVE-2026-24006

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

CVE-2026-24006 Seroval affected by Denial of Service via Deeply Nested Objects

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

CVE-2026-24006

CVE-2026-24006 affects Seroval and describes a Denial of Service risk from serializing deeply nested JS objects. Versions ≤ 1.4.0 permit object depth that can exhaust the call stack; version 1.4.1 adds a depthLimit parameter to serialization/deserialization and will throw an error when the limit ...

CVE-2026-24006 Seroval affected by Denial of Service via Deeply Nested Objects

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a depthLimit parameter in...

CVE-2026-23956

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegE...

CVE-2026-23957

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing...

EUVD-2026-3668

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing...

CVE-2026-23957 seroval is vulnerable to Denial of Service via array serialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing...

CVE-2026-23957 seroval is vulnerable to Denial of Service via array serialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing...

CVE-2026-23957

Summary (CVE-2026-23957) : The vulnerability affects the Seroval library, where an attacker can cause notably increased processing time during deserialization by overriding encoded array lengths with an excessively large value. This leads to a Denial of Service condition for versions 1.4.0 and ea...