seroval
npm13 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting serovalpage 1 of 1
- CVE-2026-104845HIGHCVSS 7.5EG 7.5fixed in 1.6.32026-10-02
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and doe…
- CVE-2026-104846CRITICALCVSS 9.8EG 9.8fixed in 1.6.22026-10-02
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearin…
- CVE-2026-116580HIGHCVSS 7.3EG 7.3fixed in 1.6.82026-10-26
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring sourc…
- CVE-2026-116581HIGHCVSS 7.5EG 7.5fixed in 1.6.82026-10-26
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create…
- CVE-2026-116582MEDIUMCVSS 4.7EG 4.7fixed in 1.6.10 or 1.0.0, by version range2026-10-26
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than …
- CVE-2026-116583MEDIUMCVSS 5.3EG 5.3fixed in 1.6.112026-10-26
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value…
- CVE-2026-116584HIGHCVSS 7.5EG 7.5fixed in 1.6.82026-10-26
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A …
- CVE-2026-23736CRITICALCVSS 9.8EG 9.8fixed in 1.4.12026-01-21
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSO…
- CVE-2026-23737HIGHCVSS 7.5EG 7.5fixed in 1.4.12026-01-21
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code…
- CVE-2026-23956HIGHCVSS 7.5EG 7.5fixed in 1.4.12026-01-22
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime me…
- CVE-2026-23957HIGHCVSS 7.5EG 7.5fixed in 1.4.12026-01-22
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deser…
- CVE-2026-24006HIGHCVSS 7.5EG 7.5fixed in 1.4.12026-01-22
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4…
- CVE-2026-59940CRITICALCVSS 9.8EG 9.8fixed in 1.5.32026-07-24
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general d…
Check whether seroval is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for seroval CVEs against the assets you own.
Book a Demo →