Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-116583 · GHSA-f86p-h4j2-7qgj

Seroval: Code injection through a typed array's own constructor property

Risk score
41/100
CVSS
5.3 v4.0
Exploit chance (30 days)
0.3%
Published
26 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copi…
Affected
seroval (npm) >= 1.6.0, < 1.6.11
Fix
Upgrade seroval to 1.6.11 or later.
Exploitation
No known exploitation

Story map

Story map: serovalTHE FLAWSTHE FIXCVE-2026-116583Seroval: Code injection througha typed array's ownconstructor propertyCVSS 5.3 · EPSS 0%CVE-2026-104846Seroval: `fromJSON()` Promisethenable assimilation invokesplugin-produced callables…CVSS 9.8 · EPSS 0%CVE-2026-116581Seroval: fromJSON deserializertrusts node-supplied arraylength and sequence doneAt…CVSS 7.5 · EPSS 0%CVE-2026-104845Seroval: Memory exhaustion viaunchecked TypedArray length inJSON deserializationCVSS 7.5 · EPSS 0%Upgrade seroval1.6.11 · 1.6.2 · 1.6.8 · 1.6.3or later on your release lineWho is exposedseroval (npm) >= 0.12.0, <= 1.6.0AMBER · PATCH THIS WEEKserovalSeroval facilitates JS valuestringification, includingcomplex structures beyondJSON.stringify capabilities.From 0.12.0 until 1.6.2,fromJSON deserialization of afulfilled Promise control node…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

seroval: Amber, patch this week. Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then i…

The flaws

  • CVE-2026-116583: Seroval: Code injection through a typed array's own constructor property (CVSS 5.3 · EPSS 0%)
  • CVE-2026-104846: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw) (CVSS 9.8 · EPSS 0%)
  • CVE-2026-116581: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS) (CVSS 7.5 · EPSS 0%)
  • CVE-2026-104845: Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization (CVSS 7.5 · EPSS 0%)

The fix

Upgrade seroval: 1.6.11 · 1.6.2 · 1.6.8 · 1.6.3 or later on your release line

Who is exposed: seroval (npm) >= 0.12.0, <= 1.6.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.3 medium
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
serovalnpm>= 1.6.0, < 1.6.111.6.11

References

Original description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

Last activity 28 Oct 2026. Patch Forecast updates every hour.