GHSA-3pfx-gxff-vg76: 
JavaScript vulnerability analysis and mitigation

Summary

fromJSON and fromCrossJSON can build a Promise that is already rejected without attaching a rejection handler. On Node.js 15 and later, the default unhandled-rejection behavior then stops the process. Any application that passes untrusted input to these functions can be stopped by a single request, before its own validation runs.

Details

Affected functions:

• fromJSON.
• fromCrossJSON.

createCrossDeserializer was fixed in an earlier release and is not affected. The deserializer marks the promises it builds as handled only when the context tracks pending values. Only createCrossDeserializer sets that up. In fromJSON and fromCrossJSON, a rejected promise in a field the caller never reads is never observed, and Node.js reports it as an unhandled rejection.

Impact

Denial of service (CWE-248). This affects any server that calls fromJSON or fromCrossJSON on client-supplied data on Node.js 15 or later with the default --unhandled-rejections=throw. This includes framework server-function handlers, such as TanStack Start, which decode the request payload with seroval before the application's auth checks or validators run. One unauthenticated request ends the process.

Patches

Fixed in seroval 1.7.2 by https://github.com/lxsmnsyc/seroval/commit/737afa10e5b1204ce1fc4bb9f999a4be00d64b23. Every promise the deserializer builds is now marked as handled. Code that awaits the promise still gets the rejection.

Workarounds

• Upgrade to 1.7.2.
• If you cannot upgrade, add a process.on('unhandledRejection', ...) handler so an unhandled rejection does not stop the process.