CVE-2026-116581: Deserialization Unvalidated Iterator Index Metadatacve-2026-116581-deserialization-unvalidated-iterator-index-metadata
A sequence/iterator object is constructed from raw deserialized node metadata ($NODE.s throw index and $NODE.l done index) without first validating that both are in-range integers. An attacker who controls the serialized payload can supply an out-of-range done index so the reconstructed iterator never reaches its done condition; application code that iterate
