GHSL-2026-200: Untrusted Seroval payloads can exhaust server resources or invoke registered functions
Published Oct 22, 2026
·Updated
Seroval deserializes typed arrays without validating their buffers, allowing malicious payloads to exhaust server resources or invoke registered functions.
Affected Software
1 affected component
npm/seroval
Event History
Oct 22, 2026
Advisory Published
via GitHub Security Lab·12:00 AM
Data Sourced
via GitHub Security Lab·12:00 AM
Description
Frequently Asked Questions
1
Which applications are exposed?
Applications using Seroval to deserialize payloads from untrusted sources are exposed. The issue concerns typed arrays processed by Seroval.
2
What must an attacker provide to exploit the issue?
An attacker needs to supply a malicious Seroval payload. Such a payload may exhaust server resources or invoke functions that have been registered.