Vulnerabilities

TI-2026-80920 CVE-2026-116584 · GHSA-wp97-x4hv-qvhp

Denial of service in Seroval fromJSON via unvalidated array length

LOW 39

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2026-10-26 Partial fix · 1.6.8 CWE-770

TI-2026-80919 CVE-2026-116583 · GHSA-f86p-h4j2-7qgj

Code injection in Seroval typed array serialization output

LOW 24

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 4.0MEDIUM 5.3 Network No auth User interaction EPSS 0.00268 Published 2026-10-26 Partial fix · 1.6.11 CWE-79

TI-2026-80918 CVE-2026-116582 · GHSA-9wx9-5pv9-3349

Script injection through RegExp sources in Seroval serialized output

LOW 21

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00188 Published 2026-10-26 Partial fix · 1.0.0, 1.6.10 CWE-116

TI-2026-80917 CVE-2026-116581 · GHSA-97r2-qh9m-474h

Seroval fromJSON deserializer hangs on crafted sequence, causing DoS

LOW 39

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00451 Published 2026-10-26 Partial fix · 1.6.8 CWE-1284

TI-2026-80682 CVE-2026-116580 · GHSA-7rv5-mrxv-xcr9

Seroval deserialization can invoke attacker-chosen callables

LOW 38

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00342 Published 2026-10-26 Partial fix · 1.6.8 CWE-502

TI-2026-66132 CVE-2026-104846 · GHSA-p6vx-979v-rg4c

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

MEDIUM 49

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00345 Published 2026-10-02 Partial fix · 1.6.2 CWE-843

TI-2026-66131 CVE-2026-104845 · GHSA-jp82-f5mq-hwhp

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

LOW 39

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00426 Published 2026-10-02 Partial fix · 1.6.3 CWE-770

TI-2026-42747 CVE-2026-59940 · GHSA-mv8w-475r-vwqw

Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

MEDIUM 50

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00812 Published 2026-08-18 Fixed in 1.5.3 CWE-502

TI-2026-19345 CVE-2026-24006 · GHSA-3j22-8qj3-26mx

Seroval affected by Denial of Service via Deeply Nested Objects

LOW 39

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00439 Published 2026-01-22 Fixed in 1.4.1 CWE-770

TI-2026-19299 CVE-2026-23957 · GHSA-66fc-rw6m-c2q6

seroval is vulnerable to Denial of Service via array serialization

LOW 39

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00439 Published 2026-01-22 Fixed in 1.4.1 CWE-770

TI-2026-19298 CVE-2026-23956 · GHSA-hx9m-jf43-8ffr

seroval affected by Denial of Service via RegExp serialization

MEDIUM 40

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00534 Published 2026-01-22 Fixed in 1.4.1 CWE-1333

TI-2026-19110 CVE-2026-23737 · GHSA-3rxj-6cgf-8cfw

seroval Affected by Remote Code Execution via JSON Deserialization

LOW 36

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00582 Published 2026-01-21 Fixed in 1.4.1 CWE-502

TI-2026-19109 CVE-2026-23736 · GHSA-hj76-42vx-jwp4

seroval Affected by Prototype Pollution via JSON Deserialization

MEDIUM 48

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00302 Published 2026-01-21 Fixed in 1.4.1 CWE-1321

Vulnerabilities

Filters