CVE-2026-104846 is a critical type confusion vulnerability in the lxsmnsyc seroval library affecting versions from 0.12.0 up to but not including 1.6.2. The flaw allows attacker-controlled JSON to trigger unexpected code execution via deserialization of a fulfilled Promise control node, bypassing previous remediation attempts. This issue is fixed in version 1.6.2.
CVE-2026-104845 is a high-severity vulnerability in the seroval library prior to version 1.6.3. It involves unbounded allocation of resources during deserialization of TypedArrays from untrusted JSON input, which can lead to CPU or memory exhaustion and event loop starvation. The flaw does not impact confidentiality or integrity. The issue is fixed in seroval version 1.6.3.
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.
CVE-2026-24006 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The issue arises from the lack of limits on resource allocation during serialization of deeply nested JavaScript objects, leading to potential stack overflow and denial of service. The vulnerability does not impact confidentiality or integrity but can cause application crashes, affecting availability. Exploitation requires no privileges or user interaction and can be triggered remotely by processing crafted input. The vulnerability was addressed in version 1.4.1 by introducing a depthLimit parameter that throws an error when exceeded. European organizations using vulnerable versions of seroval in their software stacks, especially those handling complex data serialization, are at risk.
CVE-2026-23957 is a high-severity vulnerability in the lxsmnsyc seroval library versions prior to 1.4.1. The flaw arises from the allocation of resources without limits or throttling during the deserialization process when an attacker manipulates encoded array lengths to excessively large values. This causes a significant increase in processing time, leading to a denial-of-service (DoS) condition. The vulnerability does not impact confidentiality or integrity but severely affects availability. Exploitation requires no authentication or user interaction and can be triggered remotely over the network. The issue has been resolved in version 1.4.1.
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
CVE-2026-23736 is a high-severity prototype pollution vulnerability in the seroval JavaScript value stringification library (versions below 1.4.1). The flaw arises from improper input validation during JSON deserialization, allowing attackers to modify object prototype attributes maliciously. Exploitation requires no authentication or user interaction and can be performed remotely over the network. Successful attacks can lead to partial compromise of confidentiality, integrity, and availability of affected applications. The vulnerability is fixed in seroval version 1.4.1. European organizations using vulnerable versions in their JavaScript environments should prioritize updating to mitigate risks.
CVE-2026-23737 is a high-severity deserialization vulnerability in the lxsmnsyc seroval library versions below 1.4.1. The flaw exists in the fromJSON and fromCrossJSON functions, which improperly handle untrusted input during JSON deserialization, enabling arbitrary JavaScript code execution. Exploitation requires an attacker to perform multiple requests with partial knowledge of serialized data usage, without user interaction but with low privileges. This vulnerability can compromise confidentiality, integrity, and availability of affected systems. Although no known exploits are reported in the wild, the risk is significant due to the potential for remote code execution. The issue is fixed in version 1.4.1.