[pkg-vuln] CVE-2026-34043 in serialize-javascript@6.0.2 #1369

New Issue

kert · 2026-10-27T16:14:57Z

kert commented

2026-10-27 16:14:57 +00:00

Severity: MEDIUM
Package: serialize-javascript @ 6.0.2
Fixed in: 7.0.5

Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-34043

**Severity:** MEDIUM **Package:** `serialize-javascript` @ `6.0.2` **Fixed in:** `7.0.5` Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5. **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-34043

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-10-27 16:14:57 +00:00

kert added the quality ci labels 2026-10-27 16:14:57 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1369