CVE-2026-24006: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24006 is a Denial of Service vulnerability in the Seroval JavaScript serialization library, caused by unbounded recursion when processing deeply nested objects. In versions 1.4.0 and below, serializing objects with extreme depth can exceed the JavaScript engine's maximum call stack limit, resulting in a stack overflow. The vulnerability affects the seroval npm package for Node.js in all versions prior to 1.4.1. It was published on January 21–22, 2026, and carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-770 (Allocation of Resources Without Limits or Throttling): Seroval's serialization and deserialization methods use recursive traversal of JavaScript object graphs without enforcing any depth limit, allowing an attacker to craft a payload with arbitrarily deep nesting that exhausts the call stack. The attack vector is network-accessible, requires no authentication or user interaction, and has low complexity — an attacker simply needs to supply a deeply nested object to any application endpoint that passes untrusted input to Seroval's serialization functions. The fix introduced a depthLimit parameter in version 1.4.1 that throws an error when the configured depth is exceeded, preventing unbounded recursion (GitHub Advisory, Patch Commit).

Successful exploitation causes a Denial of Service by crashing or hanging the Node.js process running Seroval, making the affected service unavailable to legitimate users. There is no impact on confidentiality or data integrity — the vulnerability is purely an availability issue. Any application that accepts externally supplied data and passes it through Seroval's serialization or deserialization methods is at risk, and a single malicious request can trigger the condition (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036%, reflecting a low probability of exploitation in the near term. Despite the low exploitation likelihood, the attack requires no privileges or user interaction, making it trivially exploitable if a vulnerable endpoint is exposed.

1. Identify a target: Find a web application or API endpoint that uses the seroval npm package (versions ≤ 1.4.0) to serialize or deserialize user-supplied input.
2. Craft a deeply nested payload: Construct a JavaScript object or JSON-like structure with extreme nesting depth — for example, {a:{a:{a:{a:...}}}} repeated thousands of times — sufficient to exceed the Node.js call stack limit.
3. Submit the payload: Send the crafted payload to the target endpoint via an HTTP request (e.g., POST body, query parameter, or WebSocket message) that the application passes to Seroval's serialize(), deserialize(), or related methods.
4. Trigger stack overflow: Seroval's recursive traversal processes the nested object without depth checking, causing a RangeError: Maximum call stack size exceeded exception that crashes or destabilizes the Node.js process, resulting in service unavailability (GitHub Advisory).

• Logs: Node.js application logs showing RangeError: Maximum call stack size exceeded errors originating from Seroval serialization/deserialization code paths; repeated unhandled exception crashes in the application process.
• Network: Unusual HTTP requests with abnormally large or deeply nested JSON/object payloads sent to API endpoints; repeated requests from the same source IP triggering application restarts.
• Process: Unexpected Node.js process crashes or restarts correlated with inbound requests; process monitoring alerts for abnormal termination of the application service.

Upgrade the seroval npm package to version 1.4.1 or later, which introduces a depthLimit parameter in all serialization and deserialization methods; an error is thrown if the depth limit is exceeded, preventing stack overflow (GitHub Advisory, Patch Commit). As a short-term workaround where upgrading is not immediately possible, validate and limit the depth of user-supplied objects before passing them to Seroval, or restrict access to endpoints that invoke Seroval serialization. The seroval-plugins package should also be updated to version 1.4.1 or later as it has a peer dependency on seroval.

The vulnerability was disclosed by the library's maintainer (lxsmnsyc) via a GitHub Security Advisory on January 21, 2026, with credit to coordinator tweidinger (GitHub Advisory). Red Hat tracked the issue via Bugzilla and assigned it high severity (Red Hat Bugzilla). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregator reporting has been observed.