PT-2026-28596 · Unknown · Serialize-Javascript

Tomeraberbach · Published 2026-03-27 · Updated 2026-05-27 · CVE-2026-34043

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions serialize-javascript versions prior to 7.0.5

Description This issue involves a Denial of Service (DoS) caused by CPU exhaustion. When serializing a specially crafted "array-like" object – an object inheriting from Array.prototype with a very large length property – the process enters an intensive loop, consuming 100% CPU and causing indefinite hanging. The vulnerability occurs when using the serialize() function with untrusted or user-controlled objects. The issue is exacerbated if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object. The problem was addressed by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.

Recommendations Upgrade to version 7.0.5 or later.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-834

CWE-400

Related Identifiers

ALSA-2026:21286

ALSA-2026:21291

ALSA-2026:21293

CLEANSTART-2026-BE61221

CVE-2026-34043

GHSA-QJ8W-GFJ5-8C6V

Affected Products

Serialize-Javascript

References · 195

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34043.json · Exploit
• https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b · Patch
• https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-21286.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-34043 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34043 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-34043 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note