CVE-2026-104845

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization.

Seroval from 0.12.0 until 1.6.2 has a vulnerability in fromJSON deserialization of a fulfilled Promise control node that can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.

Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.

In Seroval from 1.4.1 until 1.6.8, fromJSON and fromCrossJSON do not require an array node's element list to be an actual array. A small crafted payload can supply an attacker-controlled length that determines memory allocation and decoder iterations independently of payload size, allowing an unauthenticated request to exhaust the process or block its thread. The issue was fixed in version 1.6.8.

In Seroval from 1.6.0 until 1.6.11, JavaScript-output APIs derive a typed array's constructor name from a property that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and serializes it, the attacker-controlled name is written as executable JavaScript.

In Seroval prior to 1.0.0 and from 1.5.5 until 1.6.10, JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. When an application builds a RegExp from untrusted input and embeds the result in a script element, the crafted source can terminate the element and execute script.

Seroval prior to 1.6.8 does not validate a sequence node's done index in fromJSON and fromCrossJSON. A crafted done index can create an iterator that never finishes when consumed to completion, allowing an unauthenticated request to block the event loop, exhaust memory, or make the service unavailable.

In Seroval prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted input and an application plugin returning a callable value or an object exposing an 'on' method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value.