74 matches found
CVE-2026-116584
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...
CVE-2026-116581
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...
CVE-2026-116580
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...
CVE-2026-116584 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...
EUVD-2026-110463
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled...
CVE-2026-116584
The Seroval library (versions 1.4.1 through 1.6.8 ) is vulnerable to a denial of service via the fromJSON and fromCrossJSON functions. The root cause is a failure to validate the element list length of array nodes, allowing an attacker to provide a crafted payload with an artificially large lengt...
CVE-2026-116581
The Seroval library (prior to version 1.6.8 ) is vulnerable to an unauthenticated Denial of Service (DoS) via the fromJSON and fromCrossJSON deserializers. The root cause is a lack of validation for a sequence node's done index; a crafted index can create an iterator that never finishes, causing ...
EUVD-2026-110367
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...
CVE-2026-116581 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON and fromCrossJSON do not validate a sequence node's done index. A crafted done index can create an iterator that never finishes when application code...
EUVD-2026-110242
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.onlistener without requiring source to be a genuine internal stream. With untrusted Seroval...
CVE-2026-104846
A type confusion vulnerability was found in the seroval npm package. The fromJSON deserialization function, when processing a fulfilled Promise control node, can pass a plugin-produced callable-bearing thenable to a native ECMAScript Promise resolver. Thenable assimilation then invokes the callab...
NPM: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
NPM: Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw vulnerability discovered by ? in WordPress Npm seroval versions = 0.12.0, = 1.6.0...
GHSA-P6VX-979V-RG4C Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...
EUVD-2026-91747
Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw...
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...
EUVD-2026-91744
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization...
GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...
CVE-2026-104846
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...
CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...