CVE-2026-24006: Seroval affected by Denial of Service via Deeply Nested Objects

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-01-22 · updated 2026-06-17
Weakness: CWE-770

Description

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

Affected products

lxsmnsyc seroval: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: lxsmnsyc seroval 1.4.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-24006 or the next vulnerability affects your stack