https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 30 Oct 2026 07:17:08 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116581 <p>Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node&#39;s done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.</p> <p>Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node&#39;s done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116581 https://db.gcve.eu/vuln/ghsa-97r2-qh9m-474h <p><strong>Affected:</strong> npm: seroval</p> <p>### Summary</p> <p>`fromJSON` and `fromCrossJSON` used two node fields without checking them.</p> <p>- An array node&#39;s element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node&#39;s done index was not checked. A crafted value produced an iterator that never finished.</p> <p>### Impact</p> <p>A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request.</p> <p>- The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever.</p> <p>### Patches</p> <p>Fixed in `seroval@1.6.8`.</p> <p>- Element lists must be arrays. - A sequence node&#39;s throw and done indices must be integers from -1 up to the last element index.</p> <p>Invalid input throws `SerovalMalformedNodeError`.</p> <p>### Workarounds</p> <p>None. Upgrade to 1.6.8.</p> <p><strong>Affected:</strong> npm: seroval</p> <p>### Summary</p> <p>`fromJSON` and `fromCrossJSON` used two node fields without checking them.</p> <p>- An array node&#39;s element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node&#39;s done index was not checked. A crafted value produced an iterator that never finished.</p> <p>### Impact</p> <p>A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request.</p> <p>- The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever.</p> <p>### Patches</p> <p>Fixed in `seroval@1.6.8`.</p> <p>- Element lists must be arrays. - A sequence node&#39;s throw and done indices must be integers from -1 up to the last element index.</p> <p>Invalid input throws `SerovalMalformedNodeError`.</p> <p>### Workarounds</p> <p>None. Upgrade to 1.6.8.</p> https://db.gcve.eu/vuln/ghsa-97r2-qh9m-474h