Skip to contentLxsmnsyc Seroval vulnerabilities
- lxsmnsyc serovalSeroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthCVE-2026-116584Fix available7.5 High
- lxsmnsyc serovalSeroval: Code injection through a typed array's own constructor propertyCVE-2026-116583Fix available5.3 Medium
- lxsmnsyc serovalSeroval: Script injection through RegExp sources in serialized outputCVE-2026-116582Fix available4.7 Medium
- lxsmnsyc serovalSeroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)CVE-2026-116581Fix available7.5 High
- lxsmnsyc serovalSeroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkCVE-2026-116580Public exploitFix available7.3 High
- lxsmnsyc serovalSeroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)CVE-2026-104846Fix available9.8 Critical
- lxsmnsyc serovalSeroval: Memory exhaustion via unchecked TypedArray length in JSON deserializationCVE-2026-104845Fix available7.5 High
- lxsmnsyc serovalSeroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserializationCVE-2026-59940Fix available9.8 Critical
- lxsmnsyc serovalSeroval affected by Denial of Service via Deeply Nested ObjectsCVE-2026-24006Fix available7.5 High
- lxsmnsyc serovalseroval is vulnerable to Denial of Service via array serializationCVE-2026-23957Fix available7.5 High
- lxsmnsyc serovalseroval affected by Denial of Service via RegExp serializationCVE-2026-23956Fix available7.5 High
- lxsmnsyc serovalseroval Affected by Remote Code Execution via JSON DeserializationCVE-2026-23737Fix available7.5 High
- lxsmnsyc serovalseroval Affected by Prototype Pollution via JSON DeserializationCVE-2026-23736Fix available7.3 High