CLSA-2026-1792286818 TuxCare security update for seroval-plugins (1 CVE)

TuxCare rebuilt seroval-plugins to address 1 CVE. Fixed in 1.5.6-tuxcare.2...

CLSA-2026-1792286817 TuxCare security update for seroval-plugins (1 CVE)

TuxCare rebuilt seroval-plugins to address 1 CVE. Fixed in 1.5.6-tuxcare.1...

CVE-2026-104846

A type confusion vulnerability was found in the seroval npm package. The fromJSON deserialization function, when processing a fulfilled Promise control node, can pass a plugin-produced callable-bearing thenable to a native ECMAScript Promise resolver. Thenable assimilation then invokes the callab...

NPM: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

NPM: Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw vulnerability discovered by ? in WordPress Npm seroval versions = 0.12.0, = 1.6.0...

EUVD-2026-91747

Seroval: fromJSON Promise thenable assimilation invokes plugin-produced callables bypass of GHSA-mv8w-475r-vwqw...

GHSA-P6VX-979V-RG4C Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

A fulfilled Promise node deserialized by fromJSON can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] GHSA-mv8w-475r-vwqw / CVE-2026-59940 and affects every plugin-capable release fr...

GHSA-JP82-F5MQ-HWHP Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Summary deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this:...

EUVD-2026-91744

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization...

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

NPM: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization vulnerability discovered by ? in WordPress Npm seroval versions = 1.6.2...

Allocation of Resources Without Limits or Throttling

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via createTypedArrayNode, createBigIntTypedArrayNode, and createDataViewNode in base-primitives.ts, and the corresponding deserialization paths in...

Access of Resource Using Incompatible Type ('Type Confusion')

Overview seroval is a Stringify JS values Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the deserializePromise and deserializePromiseFulfill functions in deserializer.ts, where a thenable object an object with a then property...

CVE-2026-104845

A flaw was found in seroval. A remote attacker can cause a Denial of Service DoS by providing crafted JSON input containing an excessively large array length during data deserialization. Due to missing bounds validation when reconstructing array structures, the application synchronously allocates...

CVE-2026-104845

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can...

CVE-2026-104846

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846

The Seroval library (versions 0.12.0 through 1.6.2 ) is vulnerable to an unexpected code execution flaw during the fromJSON deserialization process. The root cause involves the deserialization of a fulfilled Promise control node, which can pass a plugin-produced callable-bearing thenable to a nat...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...

CVE-2026-104846 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenab...