SE
Product
seroval
13
CVEs
0
On KEV
9.8
Max CVSS
7
New 30D
Severity mix
Critical 3High 8Medium 2Low 0
Watch
Add seroval to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-116584 New | 7.5 | Oct 26 | Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length Affected: >= 1.4.1, < 1.6.8 |
| CVE-2026-116581 New | 7.5 | Oct 26 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) Affected: < 1.6.8 |
| CVE-2026-104845 | 7.5 | Oct 2 | Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization Affected: < 1.6.3 |
| CVE-2026-24006 | 7.5 | Jan 22 | Seroval affected by Denial of Service via Deeply Nested Objects Affected: < 1.4.1 |
| CVE-2026-23957 | 7.5 | Jan 22 | seroval is vulnerable to Denial of Service via array serialization Affected: < 1.4.1 |
| CVE-2026-23956 | 7.5 | Jan 22 | seroval affected by Denial of Service via RegExp serialization Affected: >= 0.2.0, < 1.4.1 |
| CVE-2026-23737 | 7.5 | Jan 21 | seroval Affected by Remote Code Execution via JSON Deserialization Affected: < 1.4.1 |
| CVE-2026-116580 New | 7.3 | Oct 26 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check Affected: < 1.6.8 |
Showing 8