CVE-2026-116583

A flaw was found in seroval. A remote attacker could achieve arbitrary code execution in an application or web page that processes serialized data. When an application serializes a typed array containing untrusted properties, seroval improperly derives constructor names from attacker-controlled...

CVE-2026-116582

A flaw was found in seroval. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by supplying crafted regular expression input to an application that serializes and embeds it into an HTML script element. Because the library fails to properly escape regular...

CVE-2026-116584

A flaw was found in seroval. A remote, unauthenticated attacker can trigger a Denial of Service DoS by supplying a crafted serialized payload containing a manipulated array length. Because the deserialization routines do not verify that an array node contains a valid list of elements, the...

CVE-2026-116581

A flaw was found in seroval. An unauthenticated remote attacker can cause a Denial of Service DoS by sending crafted input to an application that deserializes untrusted data. Due to improper validation of sequence node indices during deserialization, consuming the crafted input creates an infinit...

CVE-2026-116580

A flaw was found in seroval. During deserialization, the process of converting serialized data back into live objects, the library fails to properly validate internal stream sources. A remote attacker can exploit this issue by supplying crafted input that reuses object identifiers, causing the...

CVE-2026-116584

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

CVE-2026-116583

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-116582

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...

CVE-2026-116580

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...

CVE-2026-116581

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...

CVE-2026-116584

The Seroval library (versions 1.4.1 through 1.6.8 ) is vulnerable to a denial of service via the fromJSON and fromCrossJSON functions. The root cause is a failure to validate the element list length of array nodes, allowing an attacker to provide a crafted payload with an artificially large lengt...

EUVD-2026-110463

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...

CVE-2026-116583

The Seroval library (versions 1.6.0 through 1.6.11 ) contains a code injection vulnerability. The JavaScript-output APIs incorrectly derive a typed array's constructor name from a property that can be replaced by an own constructor property . If application code copies untrusted properties onto a...

EUVD-2026-110462

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

CVE-2026-116583 Seroval: Code injection through a typed array's own constructor property

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When...

EUVD-2026-110449

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...

CVE-2026-116582

The Seroval JavaScript stringification library is vulnerable to script injection in versions prior to 1.0.0 and from 1.5.5 through 1.6.10 . The vulnerability exists because the JavaScript-output APIs (such as serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Se...

CVE-2026-116582 Seroval: Script injection through RegExp sources in serialized output

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script...

CVE-2026-116581

The Seroval library (prior to version 1.6.8 ) is vulnerable to an unauthenticated Denial of Service (DoS) via the fromJSON and fromCrossJSON deserializers. The root cause is a lack of validation for a sequence node's done index; a crafted index can create an iterator that never finishes, causing ...