Description
seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.6.0, < 1.6.11
- Patched version(s): 1.6.11
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: Code injection through a typed array's own constructor property and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Seroval: Script injection through RegExp sources in serialized output - CVE-2026-116582
- Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix) - CVE-2026-73649
- Handlebars: JavaScript Injection via Own Property Check Bypass - CVE-2026-106445
- protobuf.js: Code injection through bytes field defaults in generated toObject code - CVE-2026-44293
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026