CVE-2026-104845

Summary

The flaw allows attackers to cause excessive CPU and memory allocation by crafting malicious JSON data that specifies large array-like structures, leading to denial of service through event loop starvation.

Exploitability

Exploitation is straightforward with a small crafted JSON payload containing a large length value, requiring no authentication or user interaction.

Blast radius

The impact could affect any application using Seroval's deserialization functions, potentially causing widespread service unavailability across affected systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.6.3 or later to fix the unchecked array allocation vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.