CVE-2026-34043: Denial of Service in serialize-javascript via Crafted Array-like Objects
Summary
CVE-2026-34043: Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects. Affects serialize-javascript versions < 7.0.5. Fixed in 7.0.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
serialize-javascript is a widely used npm package that safely serializes JavaScript objects into a format that can be safely embedded in HTML. It is commonly utilized in web applications to handle user input and data serialization. However, it has a vulnerability that can lead to CPU exhaustion, making applications unresponsive when processing certain specially crafted objects.
Vulnerability Detail
The vulnerability arises from a Denial of Service (DoS) condition caused by CPU exhaustion. When the serialize-javascript package attempts to serialize a specially crafted 'array-like' object (an object that inherits from Array.prototype but has a very large length property), it enters an intensive loop that consumes 100% CPU resources and hangs indefinitely. This issue primarily affects applications that serialize untrusted or user-controlled objects, especially if they are also vulnerable to Prototype Pollution or handle untrusted data via YAML Deserialization.
How To Fix
Latest published version: 7.1.3 as of 22 Oct 2026
npm install serialize-javascript@7.1.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.5
This is the first release that contains the fix.
npm install serialize-javascript@7.0.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
While there is no direct code-level workaround within the library itself, users can mitigate the risk by validating and sanitizing all input before passing it to the serialize() function. Additionally, ensure that the environment is protected against Prototype Pollution. Here is an example of input validation:
function validateInput(input) {
if (typeof input !== 'object' || input === null) {
throw new Error('Invalid input: must be a non-null object.');
}
// Further validation logic...
}
Conclusion
The serialize-javascript package has a critical Denial of Service vulnerability that can lead to CPU exhaustion when handling specially crafted objects. Users are strongly advised to upgrade to version 7.0.5 or later to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for serialize-javascript →
FAQ
The vulnerability is a Denial of Service (DoS) issue that leads to CPU exhaustion when serializing specially crafted array-like objects.
Applications using the serialize-javascript package to serialize untrusted or user-controlled objects are at risk, especially if they are also vulnerable to Prototype Pollution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application against this vulnerability using the Vulert playground without any signup.
You should validate and sanitize all input before passing it to the serialize() function to mitigate the risk until you can upgrade.
The CVSS score of this vulnerability is 5.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for serialize-javascript.
