CVE-2026-116580 Details
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.
A vulnerability in Seroval's deserialization process for AsyncIteratorFactoryInstance can lead to the invocation of untrusted callables. This issue arises because, prior to version 1.6.8, the 'fromJSON' method did not properly validate the source of an AsyncIterator. As a result, a crafted payload could exploit this by reusing an identifier to pass a function or object from an application plugin as the source, allowing the deserializer to call the plugin's 'on' method. This vulnerability is a variant of CVE-2026-59940 and its impact on confidentiality, integrity, or availability depends on the specific behavior of the application plugin involved.
Users can upgrade to Seroval version 1.6.8, where this vulnerability has been fixed. Instructions for downloading this version are available on the Seroval GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 26, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2 | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d | [email protected] | Source CodeVendor |
| https://github.com/lxsmnsyc/seroval/releases/tag/[email protected] | [email protected] | Release NotesVendor |
| https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| lxsmnsyc Seroval | <= 1.6.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 26, 2026 | New CVE Received | [email protected] |