Critical severity · published Aug 18, 2026
CVE-2026-59940
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.5.3, seroval.fromJSON() allows attacker-controlled JSON Promise control nodes to operate on values from the general deserialization reference table without verifying genuine internal Promise resolver records, causing deserialization side effects with plugins enabled and potentially unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. This issue is fixed in version 1.5.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 57% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seroval · lxsmnsyc
< 1.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-59940
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-59940
github.com
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-mv8w-475r-vwqw
More from seroval
9.8
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
9.8
CVE-2026-23736
seroval Affected by Prototype Pollution via JSON Deserialization
7.5
CVE-2026-116584
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
CVE-2026-116581
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)
7.5
CVE-2026-104845
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization