npmPackage

seroval

13 known vulnerabilities (2 critical, 9 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: 1.7.10 (Nov 7, 2026): no advisory affects it
Newest unaffected release: 1.7.10 (Nov 7, 2026), the latest release
Advisories: 13 · 2 critical, 9 high, 2 medium

Weekly downloads: 32.7M
Dependents: 1,414
Releases: 103 since 0.1.0 (Feb 6, 2023)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-116584
Affects 1.4.1 to 1.6.7 (1.6.8 is outside it)
CVE-2026-116583
Affects 1.6.0 to 1.6.10 (1.6.11 is outside it)
CVE-2026-116582
Affects 0.1.0 to 0.15.1 (1.0.0 is outside it); 1.5.5 to 1.6.9 (1.6.10 is outside it)
CVE-2026-116581
Affects 0.1.0 to 1.6.7 (1.6.8 is outside it)
CVE-2026-116580
Affects 0.1.0 to 1.6.7 (1.6.8 is outside it)
CVE-2026-104846
Affects 0.12.0 to 1.6.1 (1.6.2 is outside it)
CVE-2026-104845
Affects 0.1.0 to 1.6.2 (1.6.3 is outside it)
CVE-2026-59940
Affects 0.1.0 to 1.5.2 (1.5.3 is outside it)
CVE-2026-24006
Affects 0.1.0 to 1.4.0 (1.4.1 is outside it)
CVE-2026-23957
Affects 0.1.0 to 1.4.0 (1.4.1 is outside it)
CVE-2026-23956
Affects 0.2.0 to 1.4.0 (1.4.1 is outside it)
CVE-2026-23737
Affects 0.1.0 to 1.4.0 (1.4.1 is outside it)
CVE-2026-23736
Affects 0.1.0 to 1.4.0 (1.4.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 13

CVE-2026-116584High 7.5
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
Affected: from 1.4.1, fixed in 1.6.8.
Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure).
The latest release, 1.7.10, is not affected.
34% of seroval downloads last week were affected versions (12.3M).
CVE-2026-116583Medium 5.3
Seroval: Code injection through a typed array's own constructor property
Affected: from 1.6.0, fixed in 1.6.11.
Fixed in 1.6.11 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 1.7.10, is not affected.
35% of seroval downloads last week were affected versions (12.8M).
CVE-2026-116582Medium 4.7
Seroval: Script injection through RegExp sources in serialized output
Affected: from 1.5.5, fixed in 1.6.10; fixed in 1.0.0.
Fixed in 1.0.0 (released Dec 12, 2023, 1049 days before disclosure) and 1.6.10 (released Oct 18, 2026, 8 days before disclosure).
The latest release, 1.7.10, is not affected.
44% of seroval downloads last week were affected versions (16.3M).
CVE-2026-116581High 7.5
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
Affected: fixed in 1.6.8.
Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure).
The latest release, 1.7.10, is not affected.
37% of seroval downloads last week were affected versions (13.6M).
CVE-2026-116580High 7.3
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
Affected: fixed in 1.6.8.
Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure).
The latest release, 1.7.10, is not affected.
37% of seroval downloads last week were affected versions (13.6M).
CVE-2026-104846Critical 9.8
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
Affected: from 0.12.0, fixed in 1.6.2.
Fixed in 1.6.2 (released Aug 4, 2026, 59 days before disclosure).
The latest release, 1.7.10, is not affected.
27% of seroval downloads last week were affected versions (9.7M).
CVE-2026-104845High 7.5
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
Affected: fixed in 1.6.3.
Fixed in 1.6.3 (released Aug 22, 2026, 41 days before disclosure).
The latest release, 1.7.10, is not affected.
29% of seroval downloads last week were affected versions (10.7M).
CVE-2026-59940Critical 9.8
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
Affected: fixed in 1.5.3.
Fixed in 1.5.3 (released May 4, 2026, 106 days before disclosure).
The latest release, 1.7.10, is not affected.
8.6% of seroval downloads last week were affected versions (3.1M).
CVE-2026-24006High 7.5
Seroval affected by Denial of Service via Deeply Nested Objects
Affected: fixed in 1.4.1.
Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure).
The latest release, 1.7.10, is not affected.
3.5% of seroval downloads last week were affected versions (1.3M).
CVE-2026-23957High 7.5
seroval is vulnerable to Denial of Service via array serialization
Affected: fixed in 1.4.1.
Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure).
The latest release, 1.7.10, is not affected.
3.5% of seroval downloads last week were affected versions (1.3M).
CVE-2026-23956High 7.5
seroval affected by Denial of Service via RegExp serialization
Affected: from 0.2.0, fixed in 1.4.1.
Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure).
The latest release, 1.7.10, is not affected.
3.5% of seroval downloads last week were affected versions (1.3M).
CVE-2026-23737High 7.5
seroval Affected by Remote Code Execution via JSON Deserialization
Affected: fixed in 1.4.1.
Fixed in 1.4.1 (released Dec 19, 2025, 33 days before disclosure).
The latest release, 1.7.10, is not affected.
3.5% of seroval downloads last week were affected versions (1.3M).
CVE-2026-23736High 7.3
seroval Affected by Prototype Pollution via JSON Deserialization
Affected: fixed in 1.4.1.
Fixed in 1.4.1 (released Dec 19, 2025, 33 days before disclosure).
The latest release, 1.7.10, is not affected.
3.5% of seroval downloads last week were affected versions (1.3M).