CVE-2026-116581 — 脆弱性インテリジェンス
lxsmnsyc — seroval
公表日:
- CVSS
- 7.5
- CISA KEV
- 未掲載（悪用がないことを意味しません）
情報源の原文（翻訳ではありません）
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
### Summary
`fromJSON` and `fromCrossJSON` used two node fields without checking them.
- An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp.
- A sequence node's done index was not checked. A crafted value produced an iterator that never finished.
### Impact
A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request.
- The array case blocks the thread while the decoder runs.
- The sequence case makes any code that reads the resulting iterator to the end run forever.
### Patches
Fixed in `seroval@1.6.8`.
- Element lists must be arrays.
- A sequence node's throw and done indices must be integers from -1 up to the last element index.
Invalid input throws `SerovalMalformedNodeError`.
### Workarounds
None. Upgrade to 1.6.8.