Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)

Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

seroval Affected by Prototype Pollution via JSON Deserialization

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

Seroval affected by Denial of Service via Deeply Nested Objects

seroval is vulnerable to Denial of Service via array serialization

seroval affected by Denial of Service via RegExp serialization

seroval Affected by Remote Code Execution via JSON Deserialization

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

Seroval: Code injection through a typed array's own constructor property

Seroval: Script injection through RegExp sources in serialized output