CVE-2026-104846
1 advisory.
npm/seroval CVE-2026-104846: critical 9.8, EPSS 0.34%
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Action: Upgrade seroval to 1.6.2 or later.
npm i seroval@1.6.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0.12.0 | 1.6.2 | - |
Fixed versions
| 1.6.2 |
Sources
- osv: GHSA-p6vx-979v-rg4c
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-p6vx-979v-rg4c
- https://nvd.nist.gov/vuln/detail/CVE-2026-104846
- https://github.com/lxsmnsyc/seroval/commit/f1ffcc96d259f9b5b3d71feb262b58240c90e7b7
- https://github.com/lxsmnsyc/seroval
CVE-2026-104846 · published · modified · JSON