Vulnerability in unovis project

[ankitdn]

While working on unovis project, I detected a vulnerability in the seroval package. The issue occurs when the application attempts to serialize deeply nested objects. Due to the lack of depth limits during serialization, the process can exceed JavaScript’s maximum call stack size, causing the application to crash or become unresponsive. This behavior confirms the presence of a Denial of Service (DoS) vulnerability identified as CVE-2026-24006 in the affected version of the package.

CVE Link
CVE Report

[lee00678]

@ankitdn we have a PR opening for this. It will include that in the next release.

[suryahanumandla]

@ankitdn we have a PR opening for this. It will include that in the next release.

@ankitdn #706 has been merged.