CVE-2026-116584: Javascript Deserialization Unvalidated Element List Lengthcve-2026-116584-javascript-deserialization-unvalidated-element-list-length
A deserialization routine reads a parsed node's element list ($NODE.$FIELD) and consumes its `length` to size an allocation or bound a decoder loop without first verifying that the list is a real Array. Because the node comes from untrusted deserialized input, an attacker can substitute an array-like such as {"length": 2000000000} or {"length": "Infinity"}:
