Seroval
Monthly
Deserialization of attacker-controlled JSON in plugin-capable Seroval releases 0.12.0 through 1.6.1 lets a remote unauthenticated attacker cause a plugin-produced callable to be invoked unexpectedly through native Promise settlement, resulting in arbitrary code execution in applications that pass untrusted input to the library's fromJSON path. The root cause is a thenable type-confusion defect (CWE-843) that bypasses the Promise resolver remediation shipped in 1.5.3 for CVE-2026-59940 because the dangerous invocation happens inside the native Promise resolution procedure after deserialization rather than in the resolver itself. CVSS is rated 9.8, and no public exploit code was identified at time of analysis; vendor-released patch: Seroval 1.6.2.
Denial of service in Seroval versions prior to 1.6.3 allows unauthenticated remote attackers to exhaust CPU and memory by submitting a small crafted JSON payload whose TypedArray node declares an oversized element count, which the deserializer then allocates synchronously and unbounded while starving the event loop. Exploitation requires the target application to route attacker-controlled data into seroval's fromJSON or fromCrossJSON; the library is a JavaScript value-serialization dependency, so the practical exposure is limited to services that deserialize untrusted input with it. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis.
Seroval versions 1.4.0 and below are vulnerable to denial of service attacks due to unbounded recursion when serializing deeply nested objects, allowing remote attackers to crash applications by exceeding the call stack limit. The vulnerability affects the deserialization library's handling of complex data structures without depth validation. Version 1.4.1 introduces a configurable depthLimit parameter to prevent exploitation of this resource exhaustion condition.
Seroval versions 1.4.0 and below are vulnerable to denial of service through malformed deserialization payloads that specify excessively large array lengths, causing the parsing process to consume excessive CPU resources and become unresponsive. An unauthenticated remote attacker can exploit this without user interaction by sending a crafted serialized object to any application using the vulnerable library. The vulnerability has been patched in version 1.4.1.
Seroval versions 1.4.0 and below allow remote attackers to cause denial of service through maliciously crafted RegExp patterns during deserialization, either by exhausting memory with oversized patterns or triggering catastrophic backtracking (ReDoS). The vulnerability requires no authentication or user interaction and affects any application using the library to deserialize untrusted serialized data. A patch is available in version 1.4.1.
Arbitrary code execution in Seroval versions 1.4.0 and below allows authenticated attackers to execute malicious JavaScript through improper deserialization handling in the fromJSON and fromCrossJSON functions. Exploitation requires multiple requests to the affected function and partial knowledge of runtime data usage, but grants full code execution capabilities. A patch is available in version 1.4.1 and later.
Seroval is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.3).
Deserialization of attacker-controlled JSON in plugin-capable Seroval releases 0.12.0 through 1.6.1 lets a remote unauthenticated attacker cause a plugin-produced callable to be invoked unexpectedly through native Promise settlement, resulting in arbitrary code execution in applications that pass untrusted input to the library's fromJSON path. The root cause is a thenable type-confusion defect (CWE-843) that bypasses the Promise resolver remediation shipped in 1.5.3 for CVE-2026-59940 because the dangerous invocation happens inside the native Promise resolution procedure after deserialization rather than in the resolver itself. CVSS is rated 9.8, and no public exploit code was identified at time of analysis; vendor-released patch: Seroval 1.6.2.
Denial of service in Seroval versions prior to 1.6.3 allows unauthenticated remote attackers to exhaust CPU and memory by submitting a small crafted JSON payload whose TypedArray node declares an oversized element count, which the deserializer then allocates synchronously and unbounded while starving the event loop. Exploitation requires the target application to route attacker-controlled data into seroval's fromJSON or fromCrossJSON; the library is a JavaScript value-serialization dependency, so the practical exposure is limited to services that deserialize untrusted input with it. Impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H) with no confidentiality or integrity loss, and no public exploit code has been identified at time of analysis.
Seroval versions 1.4.0 and below are vulnerable to denial of service attacks due to unbounded recursion when serializing deeply nested objects, allowing remote attackers to crash applications by exceeding the call stack limit. The vulnerability affects the deserialization library's handling of complex data structures without depth validation. Version 1.4.1 introduces a configurable depthLimit parameter to prevent exploitation of this resource exhaustion condition.
Seroval versions 1.4.0 and below are vulnerable to denial of service through malformed deserialization payloads that specify excessively large array lengths, causing the parsing process to consume excessive CPU resources and become unresponsive. An unauthenticated remote attacker can exploit this without user interaction by sending a crafted serialized object to any application using the vulnerable library. The vulnerability has been patched in version 1.4.1.
Seroval versions 1.4.0 and below allow remote attackers to cause denial of service through maliciously crafted RegExp patterns during deserialization, either by exhausting memory with oversized patterns or triggering catastrophic backtracking (ReDoS). The vulnerability requires no authentication or user interaction and affects any application using the library to deserialize untrusted serialized data. A patch is available in version 1.4.1.
Arbitrary code execution in Seroval versions 1.4.0 and below allows authenticated attackers to execute malicious JavaScript through improper deserialization handling in the fromJSON and fromCrossJSON functions. Exploitation requires multiple requests to the affected function and partial knowledge of runtime data usage, but grants full code execution capabilities. A patch is available in version 1.4.1 and later.
Seroval is affected by improperly controlled modification of object prototype attributes (prototype pollution) (CVSS 7.3).