The Seroval library, used for JavaScript value stringification beyond JSON.stringify, contains a flaw in versions 1.4.0 and earlier. When a serialized array has an encoded length that is overridden with an excessively large value, the deserialization routine consumes disproportionately more time, allowing an attacker to exhaust server resources and cause a denial of service. This weakness is classified as a resource exhaustion vulnerability (CWE-770).

Applications that incorporate the lxsmnsyc:seroval library, particularly Node.js projects that depend on Seroval version 1.4.0 or older, are vulnerable. The issue applies to any environment where serialized Seroval data is processed by the library.

The CVSS score of 7.5 indicates a high severity condition, while an EPSS score of less than 1 % signals a low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred from the description; an attacker could supply a malicious payload during deserialization—either via an HTTP request, a file upload, or a messaging channel—to trigger the denial of service.