CVE-2026-59940
1 advisory.
npm/seroval CVE-2026-59940: critical 9.8, EPSS 0.81%
seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Action: Upgrade seroval to 1.5.3 or later.
npm i seroval@1.5.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.5.3 | - |
Fixed versions
| 1.5.3 |
Sources
- osv: GHSA-mv8w-475r-vwqw
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw
- https://github.com/lxsmnsyc/seroval
- https://www.npmjs.com/package/seroval/v/1.5.3
CVE-2026-59940 · published · modified · JSON