CVE-2026-116580

The Seroval library (prior to version 1.6.8 ) is vulnerable to a deserialization flaw where fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without performing a type check to ensure the source is an internal stream. An attacker providing untrusted input can craft ...