high7.5
CVE-2026-24006
Seroval affected by Denial of Service via Deeply Nested Objects
Impact
Serialization of objects with extreme depth can **exceed the maximum call stack limit**. **Mitigation**: `Seroval` introduces a `depthLimit` parameter in serialization/deserialization methods. **An error will be thrown if the depth limit is reached.**
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | seroval | <= 1.4.0 | 1.4.1 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lxsmnsyc | Seroval | before 1.4.1 |