Description
When fromJSON rebuilt an async iterator, it called on() on the iterator’s source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value’s on method.
This is a variant of GHSA-mv8w-475r-vwqw.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): <= 1.6.7
- Patched version(s): 1.6.8
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) witho and gives you actionable findings to investigate.
Start a free scanRelated Issues
- seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization - CVE-2026-59940
- Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) - CVE-2026-104846
- seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
- Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization - CVE-2026-104845
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026