PT-2026-3907 · Seroval · Seroval

Lxsmnsyc + 1 · Published 2026-01-22 · Updated 2026-02-27 · CVE-2026-24006

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Seroval versions 1.4.0 and below

Description Seroval allows JavaScript value stringification, including complex structures beyond the capabilities of JSON.stringify. In versions 1.4.0 and below, serializing objects with significant depth can cause a maximum call stack limit error. Version 1.4.1 introduces a

depthLimit

parameter in serialization/deserialization methods, which throws an error if the depth limit is exceeded.

Recommendations Update to version 1.4.1 or later.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-24006

GHSA-3J22-8QJ3-26MX

Affected Products

Seroval

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24006.json · Exploit
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx · Vendor Advisory
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Patch
• https://osv.dev/vulnerability/GHSA-3j22-8qj3-26mx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-24006 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24006 · Security Note
• https://github.com/lxsmnsyc/seroval · Note
• https://twitter.com/_cvereports/status/2014664481855467536 · Twitter Post
• https://twitter.com/cracbot/status/2016103982989770993 · Twitter Post
• https://t.me/CVEtracker/42735 · Telegram Post
• https://t.me/cveNotify/153491 · Telegram Post
• https://twitter.com/CVEnew/status/2014182481323540905 · Twitter Post