CVE-2026-104846

A type confusion vulnerability was found in the seroval npm package. The fromJSON deserialization function, when processing a fulfilled Promise control node, can pass a plugin-produced callable-bearing thenable to a native ECMAScript Promise resolver. Thenable assimilation then invokes the callab...

EUVD-2026-91747

Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw...

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...

NPM: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

NPM: Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw vulnerability discovered by ? in WordPress Npm seroval versions = 0.12.0, = 1.6.0...

GHSA-P6VX-979V-RG4C Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

EUVD-2026-91744

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization...

CVE-2026-104846

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846

The Seroval library (versions 0.12.0 through 1.6.2 ) is vulnerable to an unexpected code execution flaw during the fromJSON deserialization process. The root cause involves the deserialization of a fulfilled Promise control node, which can pass a plugin-produced callable-bearing thenable to a nat...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104845 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

PT-2026-104394

Name of the Vulnerable Software and Affected Versions Seroval versions 0.12.0 through 1.6.1 Description Seroval allows for the stringification of JavaScript values, including complex structures. A flaw in the fromJSON deserialization process allows a fulfilled Promise control node to pass a...

CVE-2026-104846: Access of Resource Using Incompatible Type

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

PT-2026-104393

Name of the Vulnerable Software and Affected Versions Seroval versions prior to 1.6.3 Description Seroval allows for the stringification of JavaScript values, including complex structures. The deserializeTypedArray function within fromJSON and fromCrossJSON trusts a deserialized source value as a...

CVE-2026-59940

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

CVE-2026-59940: Deserialization of Untrusted Data

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

GHSA-MV8W-475R-VWQW seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Summary A type confusion issue in seroval.fromJSON allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records. In applications...