CVE-2026-116583
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.
Impact
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | seroval | >= 1.6.0, < 1.6.11 | 1.6.11 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-f86p-h4j2-7qgj
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
- https://nvd.nist.gov/vuln/detail/CVE-2026-116583
- https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
- https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11