| Package | Affected versions | Patched versions |
|---|---|---|
| seroval | < 1.4.1 | 1.4.1 |
| seroval | < 1.4.1 | 1.4.1 |
Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.
Mitigation:
Seroval no longer encodes array lengths.
Instead, it computes length using Array.prototype.length during deserialization.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free