Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

Affected: npm: seroval

### Summary

`fromJSON` and `fromCrossJSON` used two node fields without checking them.

- An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished.

### Impact

A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request.

- The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever.

### Patches

Fixed in `seroval@1.6.8`.

- Element lists must be arrays. - A sequence node's throw and done indices must be integers from -1 up to the last element index.

Invalid input throws `SerovalMalformedNodeError`.

### Workarounds

None. Upgrade to 1.6.8.