Description
A fulfilled Promise node deserialized by fromJSON() can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from 0.12.0 through the current 1.6.0.
Recommendation
Update the seroval package to the latest compatible version. Followings are version details:
- Affected version(s): >= 0.12.0, <= 1.6.0
- Patched version(s): 1.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization - CVE-2026-59940
- Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) witho - CVE-2026-116580
- Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length - CVE-2026-116584
- Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) - CVE-2026-116581
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026