CVE-2026-104845: Seroval Memory Exhaustion via Unchecked TypedArray Length in JSON Deserialization
Summary
CVE-2026-104845: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization. Affects seroval versions < 1.6.3. Fixed in 1.6.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Seroval is an open-source library in the npm ecosystem designed for efficient serialization and deserialization of JSON data. It is widely used for its performance and ease of use in handling complex data structures. However, it has a vulnerability that allows for memory exhaustion due to unchecked TypedArray lengths during JSON deserialization, making it susceptible to denial-of-service attacks.
Vulnerability Detail
The vulnerability arises from the deserializeTypedArray function, which casts the source node to ArrayBuffer without validating it and does not impose limits on the element count. When a plain object with a length property is passed, it triggers the array-like TypedArray constructor, leading to excessive memory allocation. This can cause the event loop to be starved, resulting in unauthenticated CPU and memory exhaustion. The issue is exacerbated as it runs synchronously within the fromJSON method, impacting the overall performance of the service. The vulnerability does not affect confidentiality or integrity but poses a significant risk of service disruption.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
npm install seroval@1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.6.3
This is the first release that contains the fix.
npm install seroval@1.6.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can implement a runtime check to validate the input before deserialization. For example, you can add a check to ensure that the input is an instance of ArrayBuffer and that its size does not exceed a predefined limit. Here’s a sample code snippet:
function safeDeserialize(input) {
if (input instanceof ArrayBuffer && input.byteLength <= MAX_SIZE) {
return deserializeTypedArray(input);
} else {
throw new Error('Invalid input for deserialization');
}
}
Conclusion
In summary, CVE-2026-104845 affects the Seroval package, allowing for memory exhaustion through unchecked TypedArray lengths during JSON deserialization. It is crucial to update to version 1.6.3 or later to mitigate this vulnerability. Additionally, implementing input validation can serve as a temporary workaround while transitioning to the patched version.
See every vulnerability recorded for seroval →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The primary impact is unauthenticated CPU and memory exhaustion, which can lead to denial-of-service conditions for applications using Seroval.
No, this vulnerability does not pose any risks to data confidentiality or integrity; it primarily affects service availability.
If you cannot update the package immediately, implement the suggested workaround to validate inputs before deserialization to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for seroval.
