PT-2026-28596 · Unknown+1 · Serialize-Javascript+1
Tomeraberbach
·
Publicado
2026-03-27
·
Atualizado
2026-06-04
·
CVE-2026-34043
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
serialize-javascript versions prior to 7.0.5
Description
This issue involves a Denial of Service (DoS) caused by CPU exhaustion. When serializing a specially crafted "array-like" object – an object inheriting from
Array.prototype with a very large length property – the process enters an intensive loop, consuming 100% CPU and causing indefinite hanging. The vulnerability occurs when using the serialize() function with untrusted or user-controlled objects. The issue is exacerbated if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object. The problem was addressed by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.Recommendations
Upgrade to version 7.0.5 or later.
Exploit
Correção
DoS
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Rocky Linux
Serialize-Javascript