CVE-2026-34043: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34043 is a Denial of Service (DoS) vulnerability caused by CPU exhaustion in the serialize-javascript npm package (Yahoo). When the library serializes a specially crafted "array-like" object — one that inherits from Array.prototype but carries an extremely large length property — it enters an unbounded loop that consumes 100% CPU and causes the process to hang indefinitely. Affected versions are >= 5.0.0 and < 7.0.5; version 7.0.5 contains the fix. The vulnerability was privately disclosed by Tomer Aberbach, published on March 25, 2026, and assigned a CVSS v3.1 score of 5.9 (Moderate) by the GitHub Advisory Database (Attack Complexity: High) (Github Advisory). Feedly's aggregated data notes a broader CVSS estimate of 7.5 based on Low attack complexity, reflecting differing scorer assessments (Feedly).

The root cause lies in how serialize-javascript (versions 5.0.0–7.0.4) detected sparse arrays: it used instanceof Array to identify arrays and then called .filter(function(){return true}) to count elements, comparing the result against the object's length property (CWE-400, CWE-834). An attacker-controlled object that inherits from Array.prototype and declares length as Number.MAX_SAFE_INTEGER passes the instanceof Array check, causing the .filter() call to iterate up to 9,007,199,254,740,991 times — effectively an infinite loop. The fix in commit f147e90 replaces instanceof Array with Array.isArray() (which returns false for prototype-inheriting non-array objects) and replaces the .filter() sparse-detection logic with Object.keys(origValue).length !== origValue.length, eliminating the runaway iteration (Github Advisory, Patch Commit). Exploitation requires the attacker to control or influence the object passed to serialize(), which is most feasible via Prototype Pollution or untrusted YAML deserialization in the same application.

Successful exploitation causes complete availability loss of the affected Node.js process: the event loop is blocked by 100% CPU consumption and the application hangs indefinitely, resulting in a full service outage for all users. There is no confidentiality or integrity impact — the vulnerability is purely a DoS condition. Downstream IBM products that bundle serialize-javascript (including IBM App Connect Enterprise, IBM Aspera Faspex 5, IBM watsonx.data, IBM Guardium Data Security Center, IBM API Connect, and IBM Quantum Safe Remediator) are also affected, broadening the potential blast radius across enterprise environments (Github Advisory, IBM Advisory).

No public proof-of-concept exploit code has been observed, and there is no evidence of in-the-wild exploitation as of the latest Feedly update (Feedly). The EPSS score is approximately 0.019% (5th percentile), indicating a low near-term exploitation probability (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Direct exploitation is rated High complexity because the attacker must control the object passed to serialize(), typically requiring a chained vulnerability such as Prototype Pollution or unsafe YAML deserialization in the target application.

1. Identify a target application: Find a Node.js application that uses serialize-javascript versions 5.0.0–7.0.4 and exposes a code path where user-controlled data reaches the serialize() function (e.g., server-side rendering, API endpoints that serialize request data).
2. Establish an injection vector: Determine whether the application is also vulnerable to Prototype Pollution (e.g., via lodash.merge, jQuery.extend, or similar) or performs unsafe YAML deserialization of untrusted input, as these are the primary vectors for injecting a malicious object.
3. Craft the malicious object: Construct an object that inherits from Array.prototype and has length set to Number.MAX_SAFE_INTEGER (9,007,199,254,740,991). In a Prototype Pollution scenario, this could be achieved by polluting Array.prototype or by passing a crafted payload through a YAML deserialization sink.
4. Trigger serialization: Submit the crafted payload through the identified injection vector so that the malicious array-like object is passed to serialize(). The library's instanceof Array check passes, and the .filter() call begins iterating up to Number.MAX_SAFE_INTEGER times.
5. Achieve DoS: The Node.js event loop is fully blocked by the CPU-intensive loop, causing the application to become unresponsive and resulting in a complete service outage (Github Advisory, Patch Commit).

• Process Behavior: Node.js process sustaining 100% CPU utilization for an extended or indefinite period; application becomes unresponsive to all incoming requests.
• Logs: Application logs showing requests that never complete or time out; absence of normal request completion log entries following a specific input submission; Node.js process crash or OOM-killer intervention after prolonged CPU saturation.
• Network: Requests to endpoints that accept and serialize user-supplied data (e.g., SSR endpoints, API routes) that result in no response or connection timeout from the server side.
• Application Monitoring: Sudden spike to 100% CPU on a single Node.js worker thread with no corresponding increase in legitimate traffic; health-check endpoints becoming unreachable while the process is still running.

The primary remediation is to upgrade serialize-javascript to version 7.0.5 or later, which replaces the vulnerable instanceof Array / .filter() pattern with Array.isArray() and Object.keys() (Github Advisory, v7.0.5 Release). IBM has released patches for affected products including App Connect Enterprise, Aspera Faspex 5, watsonx.data, Guardium Data Security Center, API Connect, and Quantum Safe Remediator (IBM Advisory). If immediate patching is not possible, mitigate by: (1) validating and sanitizing all untrusted input before passing it to serialize(); (2) hardening the application against Prototype Pollution and unsafe YAML deserialization; and (3) implementing rate limiting and CPU usage monitoring to detect and throttle exploitation attempts.

The vulnerability was responsibly disclosed by researcher Tomer Aberbach (@TomerAberbach), who is credited in the GitHub Security Advisory (Github Advisory). IBM issued multiple security bulletins acknowledging the impact on its enterprise product portfolio, including App Connect Enterprise, Aspera Faspex, watsonx.data, Guardium Data Security Center, API Connect, and Quantum Safe Remediator (IBM Advisory). Microsoft's Security Response Center also published a reference entry for the CVE. No significant broader social media controversy or widespread community alarm has been observed, consistent with the moderate severity rating and absence of active exploitation.