GitHub Advisoryadvisory · npm

GHSA-p6vx-979v-rg4c Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

CRITICAL Published 2026-10-05 Modified 2026-10-05 Official page ↗
Aliases
CVE-2026-104846
Ecosystem
npm
Packages
seroval
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-843
Reviewed
2026-10-05

Affected packages

• npm seroval: >= 0.12.0, < 1.6.2 → fixed in 1.6.2

Description

A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in `[email protected]` (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from `0.12.0` through the current `1.6.0`.

Related

Alias · CVE (1)

  • CVE-2026-104846 Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability

Weakness · CWE (1)

  • CWE-843 Access of Resource Using Incompatible Type weakness

References