Serializing a specially crafted object that inherits the Array prototype and has a very large length property triggers an intensive loop in the serialize-javascript library, causing the process to consume 100 % of CPU and hang indefinitely. The flaw is a resource exhaustion vulnerability where the library does not properly validate the array length during serialization, leading to unbounded CPU use.

Applications using Yahoo’s serialize-javascript library prior to the 7.0.5 release are affected. Any deployment that serializes untrusted input with this older version—whether web services, command‑line tools, or embedded scripts—may experience the denial of service.

With a CVSS score of 5.9, the severity is considered medium, while an EPSS score of less than 1 % indicates a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The attack requires an attacker to supply a crafted array‑like object to the serialize function; the specific input channel depends on how the application exposes this functionality, so the vector is inferred rather than explicitly documented.