Threat Intelligence Database

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.3, deserializeTypedArray in fromJSON and fromCrossJSON trusts a deserialized source value as an ArrayBuffer and does not bound the serialized element count. An attacker can provide a small untrusted JSON object with a large length value, causing the array-like TypedArray constructor to synchronously allocate the selected number of elements and exhaust CPU or memory while starving the event loop. The offset check does not reject the crafted source because source.byteLength is undefined. DataView reaches a similar unchecked cast but throws rather than allocating, and the issue has no identified confidentiality or integrity impact. This issue is fixed in version 1.6.3.

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.

CVE-2026-24006 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The issue arises from the lack of limits on resource allocation during serialization of deeply nested JavaScript objects, leading to potential stack overflow and denial of service. The vulnerability does not impact confidentiality or integrity but can cause application crashes, affecting availability. Exploitation requires no privileges or user interaction and can be triggered remotely by processing crafted input. The vulnerability was addressed in version 1.4.1 by introducing a depthLimit parameter that throws an error when exceeded. European organizations using vulnerable versions of seroval in their software stacks, especially those handling complex data serialization, are at risk.

HighVulnerabilityGermanyFranceNetherlands+4#cve#cve-2026-24006#cwe-770

CVE-2026-23957 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The flaw arises from the allocation of resources without limits or throttling during the deserialization process when an attacker manipulates encoded array lengths to excessively large values. This causes a significant increase in processing time, leading to a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no authentication or user interaction and can be triggered remotely over the network. The issue has been resolved in version 1.4.1.

HighVulnerabilityGermanyFranceNetherlands+5#cve#cve-2026-23957#cwe-770