Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v)

[Copilot]

Dependabot flagged serialize-javascript@6.0.2, transitively pulled in via mocha, as vulnerable to a CPU exhaustion DoS when serializing crafted array-like objects. Dependabot's own PR failed because mocha@11.7.6 (latest stable) still pins serialize-javascript@^6.0.2, so a routine bump can't clear the range.

Changes

• Added a root-level npm overrides entry forcing serialize-javascript to ^7.0.5 regardless of what mocha declares
• Regenerated package-lock.json via a targeted npm update serialize-javascript, resolving to 7.0.7, avoiding a full lockfile rewrite

"overrides": {
  "@types/node": "^24.13.3",
  "serialize-javascript": "^7.0.5"
}

Reachability

serialize-javascript is a devDependency-only path (test tooling for the VS Code extension via mocha/@vscode/test-cli), never bundled into the shipped MCP server or extension runtime, and it only ever serializes test-result objects the runner itself produces, not untrusted input. High confidence this isn't an active exposure; the update mainly satisfies the scanner.

js-yaml note

The issue also asked to verify whether multiple js-yaml versions (4.3.0 transitive, 5.2.2 transitive/direct) indicate a problem. Confirmed via npm ls js-yaml --all that this is expected: different dependency chains (server/markdownlint-cli vs. @vscode/vsce's secretlint chain / mocha) require different majors, neither of which falls in a vulnerable range. This appears unrelated to the CVE and likely closable as invalid.

Original prompt

---

This section details the Dependabot vulnerability alert you should resolve

<alert_title>Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects</alert_title>
<alert_description>### Impact

What kind of vulnerability is it?

It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.

Who is impacted?

Applications that use serialize-javascript to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object.

Patches

Has the problem been patched?

Yes, the issue has been patched by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.

What versions should users upgrade to?

Users should upgrade to v7.0.5 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:

• Validating and sanitizing all input before passing it to the serialize() function.
• Ensuring the environment is protected against Prototype Pollution.
• Upgrading to v7.0.5 as soon as possible.

Acknowledgements

Serialize JavaScript thanks Tomer Aberbach (@TomerAberbach) for discovering and privately disclosing this issue.</alert_description>

moderate
GHSA-qj8w-gfj5-8c6v, CVE-2026-34043
serialize-javascript
npm
<vulnerable_versions>6.0.2</vulnerable_versions>
<patched_version>7.0.5</patched_version>
<manifest_path>package-lock.json</manifest_path>

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5 https://nvd.nist.gov/vuln/detail/CVE-2026-34043 https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0 https://github.com/advisories/GHSA-qj8w-gfj5-8c6v

<agent_instructions>dependabot is struggling to update - #326

But it looks like mutliple versions are transitively pulled in (from github dependency graph)

js-yaml
4.3.0
Transitive
npm · package-lock.json · Detected automatically on Jul 29, 2026 · MIT
js-yaml
5.2.2
Transitive
npm · package-lock.json · Detected automatically on Jul 29, 2026 · MIT
js-yaml
^5.2.2
Direct
npm · server/package.json · Detected automatically on Jul 29, 2026

If true, fix it.. if not true then let me know and ill close the vulnerability as invalid. use npm cli to better understand the transitive dependencies fully.</agent_instructions>

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indirect and hard to trace). If no patched version is available, check the alert_description field for a Workarounds section — the advisory may describe configuration changes or usage patterns that mitigate the vulnerability without a version update. If a workaround is available, apply it and leave a code comment referencing the advisory identifier explaining it is a temporary mitigation. If neither a ...

• Resolves advanced-security/codeql-development-mcp-server alert Build(deps-dev): bump eslint from 9.39.2 to 10.0.0 #56

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[felickz]

I saw this after assigning to copilot: #327 (comment)

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
npm/serialize-javascript	7.0.7	🟢 4.1	Details Check Score Reason Maintained 🟢 4 4 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 4 Packaging ⚠️ -1 packaging workflow not detected Code-Review 🟢 3 Found 6/20 approved changesets -- score normalized to 3 Pinned-Dependencies 🟢 3 dependency not pinned by hash detected -- score normalized to 3 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected License 🟢 9 license file detected Fuzzing ⚠️ 0 project is not fuzzed Branch-Protection ⚠️ -1 internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md Signed-Releases ⚠️ -1 no releases found Security-Policy ⚠️ 0 security policy file not detected SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0

Scanned Files

• package-lock.json

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Review details

• Files reviewed: 1/2 changed files
• Comments generated: 0 new
• Review effort level: Low

[felickz]

@copilot fix this one too while you are at it:

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) #80
Open
On @hono/node-server (npm) package-lock.json • last week
Dependabot cannot update to the required version
One or more other dependencies require a version that is incompatible with this update.

Package
Affected versions
Patched version
@hono/node-server
(npm)
< 2.0.5
2.0.5

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot fix this one too while you are at it:

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) #80
...

Fixed in 814512c.

I added a root overrides entry for @hono/node-server to ^2.0.5 and regenerated the lockfile with a targeted npm update. It now resolves to @hono/node-server@2.0.12 via @modelcontextprotocol/sdk@1.29.0 (npm ls @hono/node-server --all).

[felickz]

@copilot ok that was a bad idea -- too many things failing - revert hono/node-server and just keep the other changes :)

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

[Copilot]

@copilot ok that was a bad idea -- too many things failing - revert hono/node-server and just keep the other changes :)

Done in 6985fa5.

I reverted the @hono/node-server override and restored its lockfile resolution, while keeping the serialize-javascript fix unchanged.