Seroval, a JavaScript value stringifier, can convert complex data structures in Node.js applications. In versions 1.4.0 and earlier, the serialization process may recurse into a depth that exceeds the JavaScript engine's maximum call stack size, generating an unhandled exception that can crash the runtime. This leads to a denial of service. The issue corresponds to CWE-770, Excessive Resource Consumption.

The vulnerable product is Seroval, provided by lxsmnsyc. All releases up to and including 1.4.0 are affected; the remediation was added in 1.4.1, which introduces a depthLimit parameter to bound the recursion depth during serialization and deserialization.

The CVSS score of 7.5 indicates high severity, but the EPSS score is listed as <1%, meaning the likelihood of exploitation is very low. Seroval is not present in CISA’s KEV catalog. The flaw can be triggered by supplying a deeply nested object to any code path that serializes or deserializes user input with Seroval, which may be reachable from remote or local sources. Because the vulnerability causes a stack overflow that crashes the process, it results in service downtime rather than code execution.