high7.5
CVE-2026-23957
Seroval affected by Denial of Service via Array serialization
Impact
Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to **significantly increase processing time**. **Mitigation**: `Seroval` no longer encodes array lengths. Instead, it computes length using `Array.prototype.length` during deserialization.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | seroval | <= 1.4.0 | 1.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lxsmnsyc | Seroval | before 1.4.1 |