CVE-2026-24006
📋 TL;DR
Seroval versions 1.4.0 and below have a stack overflow vulnerability when serializing deeply nested objects, causing denial of service. This affects applications using Seroval for JavaScript value serialization. The vulnerability can be triggered by malicious input to serialization functions.
💻 Affected Systems
- Seroval
📦 What is this software?
Seroval by Lxsmnsyc
⚠️ Risk & Real-World Impact
Worst Case
Application crashes due to stack overflow, causing complete denial of service and potential data loss in unsaved operations.
Likely Case
Application instability or crashes when processing maliciously crafted serialization requests, leading to service disruption.
If Mitigated
Controlled error handling with depth limit prevents crashes, though serialization requests exceeding limit will fail.
🎯 Exploit Status
Exploitation requires ability to provide input to serialization functions. No authentication bypass needed if serialization endpoints are exposed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.4.1
Vendor Advisory: https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx
Restart Required: No
Instructions:
1. Update Seroval package to version 1.4.1 or higher. 2. Run npm update seroval or yarn upgrade seroval. 3. Test serialization functionality after update.
🔧 Temporary Workarounds
Implement input validation
allValidate and limit depth of objects before passing to Seroval serialization functions
Wrap serialization calls
allWrap Seroval calls with try-catch blocks and implement custom depth checking
🧯 If You Can't Patch
- Implement rate limiting on serialization endpoints to reduce attack surface
- Deploy application-level monitoring for stack overflow errors and implement automatic restart mechanisms
🔍 How to Verify
Check if Vulnerable:
Check package.json for Seroval version <=1.4.0 or examine node_modules/seroval/package.jsonCheck Version:
npm list seroval or grep version node_modules/seroval/package.jsonVerify Fix Applied:
Verify Seroval version is >=1.4.1 and test serialization with deeply nested objects to ensure proper error handling📡 Detection & Monitoring
Log Indicators:
- Stack overflow errors
- Maximum call stack size exceeded errors
- Application crashes during serialization
Network Indicators:
- Repeated serialization requests with large payloads
- Unusually deep JSON structures in requests
SIEM Query:
source="application.logs" AND ("Maximum call stack" OR "stack overflow" OR "RangeError")