CVE-2026-59940 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine...

NPM: seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

NPM: seroval: seroval.fromJSON Promise resolver type confusion invokes attacker-controlled methods during deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.5.2...

CVE-2024-43357

ECMA-262 is the language specification for the scripting language ECMAScript. A problem in the ECMAScript JavaScript specification of async generators, introduced by a May 2021 spec refactor, may lead to mis-implementation in a way that could present as a security vulnerability, such as type...