CVE-2026-104845: Seroval TypedArray DOS Vulnerability

CVE-2026-104845 Overview

CVE-2026-104845 is a resource exhaustion vulnerability in Seroval, a JavaScript serialization library that handles complex structures beyond JSON.stringify capabilities. The flaw resides in deserializeTypedArray within fromJSON and fromCrossJSON, where the function trusts a deserialized source value as an ArrayBuffer without bounding the serialized element count. An attacker can submit a small untrusted JSON object containing a large length value. The TypedArray constructor then synchronously allocates the attacker-selected number of elements, exhausting CPU or memory and starving the Node.js event loop. The issue is fixed in version 1.6.3.

Critical Impact

Remote, unauthenticated attackers can trigger denial of service by submitting crafted JSON payloads that force synchronous allocation of oversized TypedArrays, blocking the event loop.

Affected Products

• Seroval (npm package seroval) versions prior to 1.6.3
• Applications using fromJSON for untrusted input deserialization
• Applications using fromCrossJSON for untrusted input deserialization

Discovery Timeline

• 2026-10-02 - CVE-2026-104845 published to NVD
• 2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-104845

Vulnerability Analysis

The vulnerability is classified as [CWE-770] Allocation of Resources Without Limits or Throttling. Seroval's deserializeTypedArray function reconstructs a TypedArray from a serialized representation using three fields: the backing source, an offset, and an element length. The function trusts the deserialized source as an ArrayBuffer without verifying its type or that the length value is bounded by the source's capacity.

When an attacker supplies a source that lacks a defined byteLength property, the existing offset check (offset > source.byteLength) evaluates against undefined and fails to reject the crafted payload. The TypedArray constructor then proceeds to synchronously allocate the attacker-controlled number of elements, blocking the single-threaded JavaScript event loop while memory and CPU are exhausted.

Root Cause

The root cause is a missing upper bound on the length field (node.l) combined with insufficient type validation of the deserialized source value. The DataView code path reaches a similar unchecked cast but throws rather than allocating, limiting the impact to the TypedArray branch.

Attack Vector

Any application that calls fromJSON or fromCrossJSON on attacker-controlled input is exposed. The attacker crafts a minimal JSON object whose source value is not a real ArrayBuffer and whose length field holds a large integer. Delivery requires only network reachability and no authentication or user interaction. The outcome is limited to availability; confidentiality and integrity are not affected.

// Security patch in packages/seroval/src/core/context/deserializer.ts
// Source: https://github.com/lxsmnsyc/seroval/commit/ac0163e420ac7dcbbefac4d069bcefad300a4851
  const construct = getTypedArrayConstructor(node.c) as Int8ArrayConstructor;
  const source = deserialize(ctx, depth, node.f) as ArrayBuffer;
  const offset = node.b ?? 0;
- if (offset < 0 || offset > source.byteLength) {
+ if (offset < 0 || offset > source.byteLength || node.l > MAX_BASE64_LENGTH) {
    throw new SerovalMalformedNodeError(node);
  }
  const result = assignIndexedValue(

The patch adds an upper bound comparing node.l against MAX_BASE64_LENGTH, causing malformed nodes to be rejected before allocation.

Detection Methods for CVE-2026-104845

Indicators of Compromise

• Sudden spikes in Node.js process memory consumption correlated with incoming JSON requests
• Event loop lag or unresponsive HTTP endpoints following requests to deserialization endpoints
• Process crashes with out-of-memory errors in services that call fromJSON or fromCrossJSON
• JSON payloads containing TypedArray node structures with abnormally large l (length) fields

Detection Strategies

• Inspect application dependency manifests (package.json, package-lock.json, yarn.lock) for seroval versions below 1.6.3
• Instrument deserialization entry points with payload size limits and timing metrics to flag anomalous requests
• Review API gateway and WAF logs for unusually structured JSON bodies hitting endpoints that invoke Seroval

Monitoring Recommendations

• Alert on Node.js event loop lag exceeding baseline thresholds using tools such as perf_hooks.monitorEventLoopDelay
• Monitor container memory and CPU usage for workloads processing user-supplied serialized data
• Enable software composition analysis to continuously flag vulnerable seroval versions across repositories

How to Mitigate CVE-2026-104845

Immediate Actions Required

• Upgrade seroval to version 1.6.3 or later in all affected applications
• Audit all code paths that pass untrusted input to fromJSON or fromCrossJSON
• Enforce request body size limits at the reverse proxy or application layer to constrain input payloads
• Deploy memory and CPU limits on affected Node.js workloads to contain resource exhaustion

Patch Information

The vulnerability is fixed in Seroval 1.6.3. The fix adds a bound check against MAX_BASE64_LENGTH for the deserialized length field and introduces a SerovalUnsupportedTypeError for invalid types. See the GitHub Security Advisory GHSA-jp82-f5mq-hwhp and the primary patch commit for details.

Workarounds

• Validate and reject oversized JSON payloads before invoking Seroval deserialization
• Wrap fromJSON and fromCrossJSON calls in worker threads to isolate event loop exhaustion
• Avoid deserializing untrusted input with Seroval until the upgrade to 1.6.3 is deployed

# Upgrade seroval to the patched version
npm install seroval@^1.6.3

# Verify installed version
npm ls seroval

# Audit dependency tree for lingering vulnerable versions
npm audit --production