seroval has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 5. The median CVSS is 7.4 (high), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.4
- Publish → KEV
- —
- Last 90 days
- 6 prev 0
Weakness classes
Products
- seroval 6
Worst active — by depth score
CVE-2026-59940Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities54CVE-2026-116584High· 7.5Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length41CVE-2026-116581High· 7.5Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)41CVE-2026-116580High· 7.3Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check40CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property29
seroval vulnerabilities
CVEs affecting seroval, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-116583Medium· 5.3Seroval: Code injection through a typed array's own constructor property
Seroval: Code injection through a typed array's own constructor property
CVE-2026-116584High· 7.5Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
CVE-2026-116582Medium· 4.7Seroval: Script injection through RegExp sources in serialized output
Seroval: Script injection through RegExp sources in serialized output
CVE-2026-116581High· 7.5Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
CVE-2026-116580High· 7.3Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
CVE-2026-59940Critical· 9.8Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general…