CVE-2026-24006

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-24006", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-19T18:49:20.659Z", "datePublished": "2026-01-22T02:32:31.913Z", "dateUpdated": "2026-01-22T12:50:51.270Z"}, "containers": {"cna": {"title": "Seroval affected by Denial of Service via Deeply Nested Objects", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx"}, {"name": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060", "tags": ["x_refsource_MISC"], "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060"}], "affected": [{"vendor": "lxsmnsyc", "product": "seroval", "versions": [{"version": "< 1.4.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T02:32:31.913Z"}, "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0\nand below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached."}], "source": {"advisory": "GHSA-3j22-8qj3-26mx", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T12:50:03.862016Z", "id": "CVE-2026-24006", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:50:51.270Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-24006", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-22T12:50:03.862016Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T12:50:46.861Z"}}], "cna": {"title": "Seroval affected by Denial of Service via Deeply Nested Objects", "source": {"advisory": "GHSA-3j22-8qj3-26mx", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "lxsmnsyc", "product": "seroval", "versions": [{"status": "affected", "version": "< 1.4.1"}]}], "references": [{"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx", "name": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060", "name": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0\nand below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T02:32:31.913Z"}}}, "cveMetadata": {"cveId": "CVE-2026-24006", "state": "PUBLISHED", "dateUpdated": "2026-01-22T12:50:51.270Z", "dateReserved": "2026-01-19T18:49:20.659Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T02:32:31.913Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "seroval", "vendor": "lxsmnsyc", "versions": [{"status": "affected", "version": "< 1.4.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "85760E40-9AB1-40EB-98A1-D1A4411AAFC5", "versionEndExcluding": "1.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0\nand below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached."}, {"lang": "es", "value": "Seroval facilita la serializaci\u00f3n de valores JS, incluyendo estructuras complejas m\u00e1s all\u00e1 de las capacidades de JSON.stringify. En las versiones 1.4.0 y anteriores, la serializaci\u00f3n de objetos con una profundidad extrema puede exceder el l\u00edmite m\u00e1ximo de la pila de llamadas. En la versi\u00f3n 1.4.1, Seroval introduce un par\u00e1metro 'depthLimit' en los m\u00e9todos de serializaci\u00f3n/deserializaci\u00f3n. Se lanzar\u00e1 un error si se alcanza el l\u00edmite de profundidad."}], "id": "CVE-2026-24006", "lastModified": "2026-06-17T10:22:28.090", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-24006", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T12:50:03.862016Z", "version": "2.0.3"}}]}, "published": "2026-01-22T03:15:47.933", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "seroval: Seroval: Denial of Service due to excessive recursion during object serialization", "id": "2431924", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2431924"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-770", "details": ["No description is available for this CVE."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-24006", "public_date": "2026-01-22T02:32:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-24006\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24006\nhttps://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060\nhttps://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx"], "statement": "This vulnerability is rated Important for Red Hat products as it can lead to a Denial of Service in applications utilizing the Seroval library. Specifically, deeply nested objects processed by Seroval versions 1.4.0 and below can exhaust the call stack, causing application instability. Red Hat products like Forgejo in Fedora and EPEL are affected if they use vulnerable versions of Seroval.", "threat_severity": "Important"}

{"analysis": {"en": {"generated_at": "2026-04-18T03:56:10.593450+00:00", "value": {"mitigation_remediation": ["Upgrade Seroval to version 1.4.1 or newer, where the depthLimit guard is available.", "Configure the depthLimit parameter when calling serialize() or deserialize() to restrict the maximum nesting depth to a value suitable for your application.", "Validate incoming data structures before passing them to Seroval, rejecting payloads that exceed an acceptable depth threshold."], "summary": {"action": "Apply patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The vulnerable product is Seroval, provided by lxsmnsyc. All releases up to and including 1.4.0 are affected; the remediation was added in 1.4.1, which introduces a depthLimit parameter to bound the recursion depth during serialization and deserialization.", "description_and_impact": "Seroval, a JavaScript value stringifier, can convert complex data structures in Node.js applications. In versions 1.4.0 and earlier, the serialization process may recurse into a depth that exceeds the JavaScript engine's maximum call stack size, generating an unhandled exception that can crash the runtime. This leads to a denial of service. The issue corresponds to CWE-770, Excessive Resource Consumption.", "risk_and_exploitability": "The CVSS score of 7.5 indicates high severity, but the EPSS score is listed as <1%, meaning the likelihood of exploitation is very low. Seroval is not present in CISA\u2019s KEV catalog. The flaw can be triggered by supplying a deeply nested object to any code path that serializes or deserializes user input with Seroval, which may be reachable from remote or local sources. Because the vulnerability causes a stack overflow that crashes the process, it results in service downtime rather than code execution."}}}}, "created": "2026-01-22T10:08:01.166946+00:00", "updated": "2026-04-18T04:00:08.420411+00:00", "vendors": ["lxsmnsyc", "lxsmnsyc$PRODUCT$seroval"]}