{"action":"Upgrade seroval to 1.5.3 or later.","affected":[{"fixed":"1.5.3","introduced":"0"}],"component":"seroval","cve_ids":["CVE-2026-59940"],"ecosystem":"npm","epss":0.00812,"exploited":false,"fixed_versions":["1.5.3"],"ghsa_id":"GHSA-mv8w-475r-vwqw","id":"tcs_01M5KG1QQYHDM0F2QC9V903WJP","modified_at":"2026-07-24T16:33:10.222996Z","published_at":"2026-07-24T16:14:05Z","references":["https://osv.dev/vulnerability/GHSA-mv8w-475r-vwqw","https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw","https://github.com/lxsmnsyc/seroval","https://www.npmjs.com/package/seroval/v/1.5.3"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-mv8w-475r-vwqw","url":"https://osv.dev/vulnerability/GHSA-mv8w-475r-vwqw"}],"summary":"seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization"}