Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

Summary

### Summary `fromJSON` and `fromCrossJSON` used two node fields without checking them. - An array node's element list was not checked to be an array. A small payload could set the length the decoder looped over. This part is also tracked in GHSA-wp97-x4hv-qvhp. - A sequence node's done index was not checked. A crafted value produced an iterator that never finished. ### Impact A service that passes untrusted input to `fromJSON` or `fromCrossJSON` can be made unavailable by an unauthenticated request. - The array case blocks the thread while the decoder runs. - The sequence case makes any code that reads the resulting iterator to the end run forever. ### Patches Fixed in `[email protected]`. - Element lists must be arrays. - A sequence node's throw and done indices must be integers from -1 up to the last element index. Invalid input throws `SerovalMalformedNodeError`. ### Workarounds None. Upgrade to 1.6.8.

Remediation

1. Inventory every seroval deployment, including staging.
2. Upgrade seroval to 1.6.8.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/advisories/GHSA-97r2-qh9m-474h
• Referencehttps://github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h
• Referencehttps://nvd.nist.gov/vuln/detail/CVE-2026-116581
• Referencehttps://github.com/lxsmnsyc/seroval/commit/cdcee3e3bc384ee844360844f8ea98fd2b275d69
• Referencehttps://github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728
• Referencehttps://github.com/lxsmnsyc/seroval/releases/tag/[email protected]