Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities.
CVE-2026-116580
Summary When fromJSON rebuilt an async iterator, it called on() on the iterator's source without checking that the source was a seroval stream. A crafted payload could pick another value as the source, such as a function returned by an application plugin. The deserializer then called that value's on method. This is a variant of GHSA-mv8w-475r-vwqw. That fix covered the promise and stream control nodes but not the async iterator node. Impact An application that passes untrusted input to fromJSON with plugins that return callable values can have those callables invoked during deserialization. What this allows depends on what the plugin's values do. Affected versions Versions up to 1.6.3 accept any value as the source. 1.6.4 rejects the reported payload. 1.6.5 to 1.6.7 check the source by node type, which a payload can get around by reusing a node id. All versions up to 1.6.7 should be treated as affected. Patches Fixed in seroval@1.6.8. Streams and sequences are now internal class instances. The deserializer checks the source value with instanceof, so plain data and plugin values are rejected no matter which node id they use. Workarounds Avoid plugins whose deserialize returns…
Assessment
- CVSS
- 7.3 (v3.1)
- Severity
- High
- EPSS
- 0.00342% chance of exploitation in the next 30 days
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 26 October 2026
- Last updated
- 28 October 2026
- Affected
- npm · seroval
- Weakness
- CWE-502
- Assigner
- security-advisories@github.com
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
At the source
References
- https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2
- https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d
- https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9
- https://nvd.nist.gov/vuln/detail/CVE-2026-116580
- https://github.com/advisories/GHSA-7rv5-mrxv-xcr9
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-116580