CVE-2026-116580

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...

EUVD-2026-110242

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...

CVE-2026-116580 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...

CVE-2026-116580

The Seroval library (prior to version 1.6.8 ) is vulnerable to a deserialization flaw where fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without performing a type check to ensure the source is an internal stream. An attacker providing untrusted input can craft ...