# seroval (npm) vulnerabilities 13 known vulnerabilities (2 critical, 9 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 1.7.10 (Nov 7, 2026): no advisory affects it - Newest unaffected release: 1.7.10 (Nov 7, 2026), the latest release - Weekly downloads: 32.7M - Dependents: 1,414 - Releases: 103 since 0.1.0 (Feb 6, 2023) - Registry: https://www.npmjs.com/package/seroval - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-116584: 1.4.1 to 1.6.7 (1.6.8 is outside it) - CVE-2026-116583: 1.6.0 to 1.6.10 (1.6.11 is outside it) - CVE-2026-116582: 0.1.0 to 0.15.1 (1.0.0 is outside it); 1.5.5 to 1.6.9 (1.6.10 is outside it) - CVE-2026-116581: 0.1.0 to 1.6.7 (1.6.8 is outside it) - CVE-2026-116580: 0.1.0 to 1.6.7 (1.6.8 is outside it) - CVE-2026-104846: 0.12.0 to 1.6.1 (1.6.2 is outside it) - CVE-2026-104845: 0.1.0 to 1.6.2 (1.6.3 is outside it) - CVE-2026-59940: 0.1.0 to 1.5.2 (1.5.3 is outside it) - CVE-2026-24006: 0.1.0 to 1.4.0 (1.4.1 is outside it) - CVE-2026-23957: 0.1.0 to 1.4.0 (1.4.1 is outside it) - CVE-2026-23956: 0.2.0 to 1.4.0 (1.4.1 is outside it) - CVE-2026-23737: 0.1.0 to 1.4.0 (1.4.1 is outside it) - CVE-2026-23736: 0.1.0 to 1.4.0 (1.4.1 is outside it) ## Advisories (13) ### [CVE-2026-116584](https://cve.now/CVE-2026-116584): Seroval \`fromJSON\`/\`fromCrossJSON\` denial of service via unvalidated array node length - Severity: High 7.5 - Published: Oct 26, 2026 - Affected: from 1.4.1, fixed in 1.6.8. - Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure). - The latest release, 1.7.10, is not affected. - 34% of seroval downloads last week were affected versions (12.3M). ### [CVE-2026-116583](https://cve.now/CVE-2026-116583): Seroval: Code injection through a typed array's own constructor property - Severity: Medium 5.3 - Published: Oct 26, 2026 - Affected: from 1.6.0, fixed in 1.6.11. - Fixed in 1.6.11 (released Oct 18, 2026, 8 days before disclosure). - The latest release, 1.7.10, is not affected. - 35% of seroval downloads last week were affected versions (12.8M). ### [CVE-2026-116582](https://cve.now/CVE-2026-116582): Seroval: Script injection through RegExp sources in serialized output - Severity: Medium 4.7 - Published: Oct 26, 2026 - Affected: from 1.5.5, fixed in 1.6.10; fixed in 1.0.0. - Fixed in 1.0.0 (released Dec 12, 2023, 1049 days before disclosure) and 1.6.10 (released Oct 18, 2026, 8 days before disclosure). - The latest release, 1.7.10, is not affected. - 44% of seroval downloads last week were affected versions (16.3M). ### [CVE-2026-116581](https://cve.now/CVE-2026-116581): Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) - Severity: High 7.5 - Published: Oct 26, 2026 - Affected: fixed in 1.6.8. - Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure). - The latest release, 1.7.10, is not affected. - 37% of seroval downloads last week were affected versions (13.6M). ### [CVE-2026-116580](https://cve.now/CVE-2026-116580): Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check - Severity: High 7.3 - Published: Oct 26, 2026 - Affected: fixed in 1.6.8. - Fixed in 1.6.8 (released Sep 29, 2026, 27 days before disclosure). - The latest release, 1.7.10, is not affected. - 37% of seroval downloads last week were affected versions (13.6M). ### [CVE-2026-104846](https://cve.now/CVE-2026-104846): Seroval: \`fromJSON()\` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) - Severity: Critical 9.8 - Published: Oct 2, 2026 - Affected: from 0.12.0, fixed in 1.6.2. - Fixed in 1.6.2 (released Aug 4, 2026, 59 days before disclosure). - The latest release, 1.7.10, is not affected. - 27% of seroval downloads last week were affected versions (9.7M). ### [CVE-2026-104845](https://cve.now/CVE-2026-104845): Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization - Severity: High 7.5 - Published: Oct 2, 2026 - Affected: fixed in 1.6.3. - Fixed in 1.6.3 (released Aug 22, 2026, 41 days before disclosure). - The latest release, 1.7.10, is not affected. - 29% of seroval downloads last week were affected versions (10.7M). ### [CVE-2026-59940](https://cve.now/CVE-2026-59940): Seroval: \`seroval.fromJSON()\` Promise resolver type confusion invokes attacker-controlled methods during deserialization - Severity: Critical 9.8 - Published: Aug 18, 2026 - Affected: fixed in 1.5.3. - Fixed in 1.5.3 (released May 4, 2026, 106 days before disclosure). - The latest release, 1.7.10, is not affected. - 8.6% of seroval downloads last week were affected versions (3.1M). ### [CVE-2026-24006](https://cve.now/CVE-2026-24006): Seroval affected by Denial of Service via Deeply Nested Objects - Severity: High 7.5 - Published: Jan 22, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure). - The latest release, 1.7.10, is not affected. - 3.5% of seroval downloads last week were affected versions (1.3M). ### [CVE-2026-23957](https://cve.now/CVE-2026-23957): seroval is vulnerable to Denial of Service via array serialization - Severity: High 7.5 - Published: Jan 22, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure). - The latest release, 1.7.10, is not affected. - 3.5% of seroval downloads last week were affected versions (1.3M). ### [CVE-2026-23956](https://cve.now/CVE-2026-23956): seroval affected by Denial of Service via RegExp serialization - Severity: High 7.5 - Published: Jan 22, 2026 - Affected: from 0.2.0, fixed in 1.4.1. - Fixed in 1.4.1 (released Dec 19, 2025, 34 days before disclosure). - The latest release, 1.7.10, is not affected. - 3.5% of seroval downloads last week were affected versions (1.3M). ### [CVE-2026-23737](https://cve.now/CVE-2026-23737): seroval Affected by Remote Code Execution via JSON Deserialization - Severity: High 7.5 - Published: Jan 21, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Dec 19, 2025, 33 days before disclosure). - The latest release, 1.7.10, is not affected. - 3.5% of seroval downloads last week were affected versions (1.3M). ### [CVE-2026-23736](https://cve.now/CVE-2026-23736): seroval Affected by Prototype Pollution via JSON Deserialization - Severity: High 7.3 - Published: Jan 21, 2026 - Affected: fixed in 1.4.1. - Fixed in 1.4.1 (released Dec 19, 2025, 33 days before disclosure). - The latest release, 1.7.10, is not affected. - 3.5% of seroval downloads last week were affected versions (1.3M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/seroval Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.