CVE-2026-24006: Seroval DoS Vulnerability

CVE-2026-24006 Overview

Seroval is a JavaScript library that facilitates value stringification, including complex structures beyond standard JSON.stringify capabilities. A Denial of Service vulnerability exists in Seroval versions 1.4.0 and below where serialization of objects with extreme depth can exceed the maximum call stack limit, causing application crashes.

Critical Impact

Attackers can craft deeply nested JavaScript objects that, when processed by Seroval, trigger a stack overflow condition leading to denial of service. This affects any application using Seroval for serialization of untrusted input.

Affected Products

• Seroval versions 1.4.0 and below
• Applications using Seroval for serialization/deserialization of user-controlled data
• Node.js and browser-based applications leveraging Seroval

Discovery Timeline

• 2026-01-22 - CVE CVE-2026-24006 published to NVD
• 2026-01-22 - Last updated in NVD database

Technical Details for CVE-2026-24006

Vulnerability Analysis

This vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). The core issue stems from Seroval's recursive processing of nested object structures without enforcing a maximum depth limit. When an attacker provides a maliciously crafted object with extreme nesting depth, the serialization process recursively traverses each level, eventually exhausting the JavaScript call stack.

The vulnerability is particularly concerning in server-side applications where Seroval processes untrusted input. A single malicious request containing a deeply nested object can crash the entire Node.js process, resulting in service unavailability for all users.

Root Cause

The root cause is the absence of depth limiting in Seroval's serialization logic. The library's recursive approach to traversing object structures means that each nested level adds a new frame to the call stack. JavaScript engines have a finite call stack size (typically around 10,000-20,000 frames depending on the environment), and exceeding this limit results in a RangeError: Maximum call stack size exceeded exception.

Prior to version 1.4.1, there was no mechanism to detect or prevent excessive recursion depth during serialization or deserialization operations.

Attack Vector

The attack vector is network-based, requiring no authentication or user interaction. An attacker can exploit this vulnerability by sending a crafted payload containing a deeply nested object structure to any endpoint that processes data through Seroval's serialization methods.

The attack is straightforward to execute: construct an object with sufficient nesting depth (typically thousands of levels) and submit it to a vulnerable application. The serialization attempt will consume stack frames until the call stack is exhausted, causing the application to crash.

For technical details on the vulnerability and its fix, refer to the GitHub Security Advisory GHSA-3j22-8qj3-26mx.

Detection Methods for CVE-2026-24006

Indicators of Compromise

• Application crashes with RangeError: Maximum call stack size exceeded errors
• Unexplained Node.js process restarts or service unavailability
• Incoming requests containing unusually large or deeply nested JSON payloads
• Spike in memory usage prior to application crashes

Detection Strategies

• Monitor application logs for stack overflow errors originating from Seroval modules
• Implement request payload size and depth validation at the API gateway level
• Use application performance monitoring (APM) tools to detect abnormal recursion patterns
• Review incoming request payloads for suspicious nesting structures

Monitoring Recommendations

• Configure alerts for repeated application crashes or process restarts
• Monitor for anomalous request patterns targeting serialization endpoints
• Set up logging for all unhandled exceptions in serialization code paths
• Track memory and CPU utilization spikes that may indicate exploitation attempts

How to Mitigate CVE-2026-24006

Immediate Actions Required

• Upgrade Seroval to version 1.4.1 or later immediately
• Audit all applications using Seroval to identify vulnerable deployments
• Implement input validation to reject excessively nested objects before serialization
• Consider implementing request payload depth limits at the application or API gateway level

Patch Information

The vulnerability has been addressed in Seroval version 1.4.1, which introduces a depthLimit parameter in serialization/deserialization methods. When the depth limit is reached, an error is thrown instead of continuing recursion. The fix can be reviewed in the GitHub commit ce9408ebc87312fcad345a73c172212f2a798060.

Workarounds

• Implement custom depth checking before passing objects to Seroval serialization methods
• Use middleware to validate and reject deeply nested objects in incoming requests
• Deploy rate limiting to reduce the impact of repeated exploitation attempts
• Consider using alternative serialization libraries if immediate patching is not feasible

# Upgrade Seroval to the patched version
npm update seroval@1.4.1

# Or install specific version
npm install seroval@^1.4.1