AIKIDO-2026-68618

TL;DR

seroval's deserializeTypedArray casts the source node to ArrayBuffer without verifying it and never bounds the element count carried in the payload. A plain object with only a length property is passed to the TypedArray constructor, which synchronously allocates that many elements inside fromJSON and fromCrossJSON, blocking the event loop on a tiny payload. The offset guard above it does not stop this because source.byteLength is undefined on the forged source, so that comparison is always false. The fix caps the declared length against a fixed maximum before construction.