CVE-2026-24006

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-24006

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

S

eroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

References
Link Resource
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 Patch
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*
History

27 Feb 2026, 14:44

Type Values Removed Values Added
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*
References () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - Patch
References () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx - () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3j22-8qj3-26mx - Mitigation, Vendor Advisory
First Time Lxsmnsyc seroval
Lxsmnsyc

22 Jan 2026, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 03:15

Updated : 2026-02-27 14:44

NVD link : CVE-2026-24006

Mitre link : CVE-2026-24006

CVE.ORG link : CVE-2026-24006

JSON object : View

Products Affected

lxsmnsyc

CWE
CWE-770

Allocation of Resources Without Limits or Throttling