CVE-2026-116581High· 7.5▾ TwilightSeroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
0.5%
Disclosed via GHSA
fromJSON and fromCrossJSON used two node fields without checking them.
A service that passes untrusted input to fromJSON or fromCrossJSON can be made unavailable by an unauthenticated request.
Fixed in [email protected].
Invalid input throws SerovalMalformedNodeError.
None. Upgrade to 1.6.8.
seroval <= 1.6.7Upgrade to a patched release:
seroval 1.6.8Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116584High· 7.5Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
CVE-2026-116580High· 7.3Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property
CVE-2026-116582Medium· 4.7Seroval: Script injection through RegExp sources in serialized output
CVE-2026-104845High· 7.5Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
CVE-2026-104846Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities