CVE-2026-34043
Published: 31 March 2026
Summary
CVE-2026-34043 is a medium-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Yahoo Serialize. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 5.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-6 (Resource Availability).
Deeper analysis
CVE-2026-34043 is a Denial of Service (DoS) vulnerability in the serialize-javascript library, a JavaScript module used to serialize JavaScript objects to a superset of JSON that supports regular expressions and functions. Versions prior to 7.0.5 are affected, where serializing a specially crafted "array-like" object—an object inheriting from Array.prototype with a very large length property—triggers an intensive loop. This causes CPU exhaustion, consuming 100% CPU and resulting in an indefinite hang. The vulnerability is rated 5.9 on the CVSS v3.1 scale (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) and is associated with CWE-400 (Uncontrolled Resource Consumption) and CWE-834 (Excessive Iteration).
Attackers can exploit this vulnerability remotely over the network without privileges or user interaction, though it requires high attack complexity to craft the malicious object. Successful exploitation leads to a DoS condition, rendering the affected process unresponsive due to total CPU utilization.
The issue has been addressed in serialize-javascript version 7.0.5, as detailed in the project's GitHub security advisory (GHSA-qj8w-gfj5-8c6v), release notes, and the patching commit (f147e90269b58bb6e539cfdf3d0e20d6ad14204b). Security practitioners should upgrade to version 7.0.5 or later to mitigate the risk.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-17288
Vulnerability details
Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits…
more
from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables remote exploitation of a JavaScript serialization library to trigger CPU exhaustion and indefinite hang via a crafted input, mapping to Endpoint Denial of Service through Application or System Exploitation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of flaws, directly mandating upgrade of the vulnerable serialize-javascript library to version 7.0.5 or later.
Protects resource availability including CPU by allocating resources per process or implementing protections against exhaustion from excessive iteration.
Validates inputs to the serialization process, preventing processing of specially crafted array-like objects with large length properties.