Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v) by Copilot · Pull Request #331 · advanced-security/codeql-development-mcp-server

Copilot · 2026-07-30T19:15:36Z

Dependabot flagged serialize-javascript@6.0.2, transitively pulled in via mocha, as vulnerable to a CPU exhaustion DoS when serializing crafted array-like objects. Dependabot's own PR failed because mocha@11.7.6 (latest stable) still pins serialize-javascript@^6.0.2, so a routine bump can't clear the range.

Changes

Added a root-level npm overrides entry forcing serialize-javascript to ^7.0.5 regardless of what mocha declares
Regenerated package-lock.json via a targeted npm update serialize-javascript, resolving to 7.0.7, avoiding a full lockfile rewrite

"overrides": {
  "@types/node": "^24.13.3",
  "serialize-javascript": "^7.0.5"
}

Reachability

serialize-javascript is a devDependency-only path (test tooling for the VS Code extension via mocha/@vscode/test-cli), never bundled into the shipped MCP server or extension runtime, and it only ever serializes test-result objects the runner itself produces, not untrusted input. High confidence this isn't an active exposure; the update mainly satisfies the scanner.

js-yaml note

The issue also asked to verify whether multiple js-yaml versions (4.3.0 transitive, 5.2.2 transitive/direct) indicate a problem. Confirmed via npm ls js-yaml --all that this is expected: different dependency chains (server/markdownlint-cli vs. @vscode/vsce's secretlint chain / mocha) require different majors, neither of which falls in a vulnerable range. This appears unrelated to the CVE and likely closable as invalid.

Original prompt

This section details the Dependabot vulnerability alert you should resolve

<alert_title>Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects</alert_title>
<alert_description>### Impact

What kind of vulnerability is it?

It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.

Who is impacted?

Applications that use serialize-javascript to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object.

Patches

Has the problem been patched?

Yes, the issue has been patched by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.

What versions should users upgrade to?

Users should upgrade to v7.0.5 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:

Validating and sanitizing all input before passing it to the serialize() function.
Ensuring the environment is protected against Prototype Pollution.
Upgrading to v7.0.5 as soon as possible.

Acknowledgements

Serialize JavaScript thanks Tomer Aberbach (@TomerAberbach) for discovering and privately disclosing this issue.</alert_description>

moderate
GHSA-qj8w-gfj5-8c6v, CVE-2026-34043
serialize-javascript
npm
<vulnerable_versions>6.0.2</vulnerable_versions>
<patched_version>7.0.5</patched_version>
<manifest_path>package-lock.json</manifest_path>

https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-qj8w-gfj5-8c6v https://github.com/yahoo/serialize-javascript/commit/f147e90269b58bb6e539cfdf3d0e20d6ad14204b https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.5 https://nvd.nist.gov/vuln/detail/CVE-2026-34043 https://github.com/yahoo/serialize-javascript/releases/tag/v5.0.0 https://github.com/advisories/GHSA-qj8w-gfj5-8c6v

<agent_instructions>dependabot is struggling to update - #326

But it looks like mutliple versions are transitively pulled in (from github dependency graph)

js-yaml
4.3.0
Transitive
npm · package-lock.json · Detected automatically on Jul 29, 2026 · MIT
js-yaml
5.2.2
Transitive
npm · package-lock.json · Detected automatically on Jul 29, 2026 · MIT
js-yaml
^5.2.2
Direct
npm · server/package.json · Detected automatically on Jul 29, 2026

If true, fix it.. if not true then let me know and ill close the vulnerability as invalid. use npm cli to better understand the transitive dependencies fully.</agent_instructions>

<task_instructions>Resolve this alert by updating the affected package to a non-vulnerable version. Prefer the lowest non-vulnerable version (see the patched_version field above) over the latest to minimize breaking changes. Include a Reachability Assessment section in the PR description. Review the alert_description field to understand which APIs, features, or configurations are affected, then search the codebase for usage of those specific items. If the vulnerable code path is reachable, explain how (which files, APIs, or call sites use the affected functionality) and note that the codebase is actively exposed to this vulnerability. If the vulnerable code path is not reachable, explain why (e.g. the affected API is never called, the vulnerable configuration is not used) and note that the update is primarily to satisfy vulnerability scanners rather than to address an active risk. If the advisory is too vague to determine reachability (e.g. 'improper input validation' with no specific API named), state that reachability could not be determined and explain why. Include a confidence level in the reachability assessment (e.g. high confidence if the advisory names a specific API and you confirmed it is or is not called, low confidence if the usage is indirect and hard to trace). If no patched version is available, check the alert_description field for a Workarounds section — the advisory may describe configuration changes or usage patterns that mitigate the vulnerability without a version update. If a workaround is available, apply it and leave a code comment referencing the advisory identifier explaining it is a temporary mitigation. If neither a ...

Resolves advanced-security/codeql-development-mcp-server alert Build(deps-dev): bump eslint from 9.39.2 to 10.0.0 #56

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

felickz · 2026-07-30T19:21:12Z

I saw this after assigning to copilot: #327 (comment)

github-actions · 2026-07-30T19:21:13Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package

Version

Score

Details

npm/serialize-javascript

7.0.7

🟢 4.1

Details

Check	Score	Reason
Maintained	🟢 4	4 commit(s) and 1 issue activity found in the last 90 days -- score normalized to 4
Packaging	⚠️ -1	packaging workflow not detected
Code-Review	🟢 3	Found 6/20 approved changesets -- score normalized to 3
Pinned-Dependencies	🟢 3	dependency not pinned by hash detected -- score normalized to 3
Dangerous-Workflow	🟢 10	no dangerous workflow patterns detected
Binary-Artifacts	🟢 10	no binaries found in the repo
Token-Permissions	⚠️ 0	detected GitHub workflow tokens with excessive permissions
CII-Best-Practices	⚠️ 0	no effort to earn an OpenSSF best practices badge detected
License	🟢 9	license file detected
Fuzzing	⚠️ 0	project is not fuzzed
Branch-Protection	⚠️ -1	internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
Signed-Releases	⚠️ -1	no releases found
Security-Policy	⚠️ 0	security policy file not detected
SAST	⚠️ 0	SAST tool is not run on all commits -- score normalized to 0

Scanned Files

package-lock.json

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

Copilot

Review details

Files reviewed: 1/2 changed files
Comments generated: 0 new
Review effort level: Low

felickz · 2026-07-30T19:36:03Z

@copilot fix this one too while you are at it:

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) #80
Open
On @hono/node-server (npm) package-lock.json • last week
Dependabot cannot update to the required version
One or more other dependencies require a version that is incompatible with this update.

Package
Affected versions
Patched version
@hono/node-server
(npm)
< 2.0.5
2.0.5

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

Copilot · 2026-07-30T19:43:57Z

@copilot fix this one too while you are at it:

Node.js Adapter for Hono: Path traversal in serve-static on Windows via encoded backslash (%5C) #80
...

Fixed in 814512c.

I added a root overrides entry for @hono/node-server to ^2.0.5 and regenerated the lockfile with a targeted npm update. It now resolves to @hono/node-server@2.0.12 via @modelcontextprotocol/sdk@1.29.0 (npm ls @hono/node-server --all).

felickz · 2026-07-30T20:05:20Z

@copilot ok that was a bad idea -- too many things failing - revert hono/node-server and just keep the other changes :)

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot

Copilot was unable to review this pull request because there is no eligible user to bill. To allow Copilot reviews on bot-authored pull requests, enable direct organization billing in your organization's Copilot settings.

Copilot · 2026-07-30T20:16:27Z

@copilot ok that was a bad idea -- too many things failing - revert hono/node-server and just keep the other changes :)

Done in 6985fa5.

I reverted the @hono/node-server override and restored its lockfile resolution, while keeping the serialize-javascript fix unchanged.

Initial plan

89c2f01

Copilot AI assigned Copilot and felickz Jul 30, 2026

Copilot AI review requested due to automatic review settings July 30, 2026 19:15

Copilot AI reviewed Jul 30, 2026

Copilot started work on behalf of felickz July 30, 2026 19:16 View session

Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v)

664796c

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 30, 2026 19:26

Copilot AI reviewed Jul 30, 2026

Copilot AI changed the title ~~[WIP] Fix CPU exhaustion Denial of Service in serialize-javascript~~ Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v) Jul 30, 2026

Copilot finished work on behalf of felickz July 30, 2026 19:28

Copilot AI requested a review from felickz July 30, 2026 19:28

felickz requested a review from Copilot July 30, 2026 19:32

Copilot started reviewing on behalf of felickz July 30, 2026 19:33 View session

Copilot AI reviewed Jul 30, 2026

View reviewed changes

Copilot started work on behalf of felickz July 30, 2026 19:36 View session

Add @hono/node-server override to patched version

814512c

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 30, 2026 19:43

Copilot AI reviewed Jul 30, 2026

Copilot finished work on behalf of felickz July 30, 2026 19:44

Copilot started work on behalf of felickz July 30, 2026 20:06 View session

chore: plan revert for hono override

f6917ce

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 30, 2026 20:11

Copilot AI reviewed Jul 30, 2026

Revert @hono/node-server override and lockfile update

6985fa5

Co-authored-by: felickz <1760475+felickz@users.noreply.github.com>

Copilot AI review requested due to automatic review settings July 30, 2026 20:16

Copilot AI reviewed Jul 30, 2026

Copilot finished work on behalf of felickz July 30, 2026 20:17

felickz closed this Jul 30, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v) - #331

Fix serialize-javascript CPU exhaustion DoS (GHSA-qj8w-gfj5-8c6v)#331
felickz with Copilot wants to merge 5 commits into
mainfrom
copilot/fix-cpu-exhaustion-vulnerability

Copilot AI commented Jul 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Reachability

js-yaml note

Patches

Workarounds

Acknowledgements

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

github-actions Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

OpenSSF Scorecard

Scanned Files

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Review details

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

felickz commented Jul 30, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jul 30, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jul 30, 2026 •

edited

Loading

github-actions Bot commented Jul 30, 2026 •

edited

Loading