Promise resolver type confusion in seroval fromJSON() deserialization (CVE-2026-59940)

A type confusion vulnerability in `seroval.fromJSON()` allows attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without verifying those values are genuine internal promise resolver records. When untrusted Seroval JSON is deserialized with plugins enabled, this can produce attacker-controlled deserialization side effects. In downstream server frameworks registering plugins that return callable wrappers, this primitive may enable unintended server-side invocation and potentially remote code execution. Affected versions: - <= 1.5.2 We recommend updating to: 1.5.3. CVSS 9.8 · our assessment: act_now Reference: https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw Details: https://vuln.today/cve/CVE-2026-59940