Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)

[ Description ]Official description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code consumes it to completion. An unauthenticated request to a service that deserializes untrusted input can therefore block the event loop, exhaust process memory, or make the service unavailable. This issue is fixed in version 1.6.8.

[ Fixes ]Fixes and patches

• seroval 1.6.8Fixed version · GitHub Advisories · npm package seroval: upgrade to 1.6.8 or later (affected <= 1.6.7)

[ Packages ]Affected open-source packages

• seroval npmAffected <= 1.6.7 · fixed in 1.6.8 · GHSA-97r2-qh9m-474h

[ References ]References

• github.com/lxsmnsyc/seroval/commit/e176f9267e59ddd6c9de89cc9fe85c5b37a5b728
• github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
• github.com/lxsmnsyc/seroval/security/advisories/GHSA-97r2-qh9m-474h