Skip to content
OpenAdvisories

Package · npm

seroval

13 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-104846

    Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a nati…

    lxsmnsyc seroval seroval npm
  • Critical 9.8
    CVE-2026-59940

    Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

    Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization refer…

    lxsmnsyc seroval seroval npm