High severity · published Oct 26, 2026
CVE-2026-116580
Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
New
7.3
CVSS
0.3%
EPSS
No
On KEV
Description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seroval · lxsmnsyc
< 1.6.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-116580
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-116580
github.com
https://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2
github.com
https://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d
github.com
https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8
github.com
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9
More from seroval
9.8
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
9.8
CVE-2026-59940
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
9.8
CVE-2026-23736
seroval Affected by Prototype Pollution via JSON Deserialization
7.5
CVE-2026-116584
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
CVE-2026-116581
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)