lxsmnsyc seroval
13 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-116584 | >= 1.4.1, < 1.6.8 | Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length | HIGH 7.5 | 0.4 % | ||
| CVE-2026-116583 | >= 1.6.0, < 1.6.11 | Seroval: Code injection through a typed array's own constructor property | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-116582 | < 1.0.0 ; >= 1.5.5, < 1.6.10 | Seroval: Script injection through RegExp sources in serialized output | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-116581 | < 1.6.8 | Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) | HIGH 7.5 | 0.5 % | ||
| CVE-2026-116580 | < 1.6.8 | Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check | HIGH 7.3 | 0.3 % | ||
| CVE-2026-104846 | >= 0.12.0, < 1.6.2 | Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-104845 | < 1.6.3 | Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization | HIGH 7.5 | 0.4 % | ||
| CVE-2026-59940 | < 1.5.3 | Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization | CRITICAL 9.8 | 0.8 % | ||
| CVE-2026-24006 | < 1.4.1 | Seroval affected by Denial of Service via Deeply Nested Objects | HIGH 7.5 | 0.4 % | ||
| CVE-2026-23957 | < 1.4.1 | seroval is vulnerable to Denial of Service via array serialization | HIGH 7.5 | 0.4 % | ||
| CVE-2026-23956 | >= 0.2.0, < 1.4.1 | seroval affected by Denial of Service via RegExp serialization | HIGH 7.5 | 0.5 % | ||
| CVE-2026-23737 | < 1.4.1 | seroval Affected by Remote Code Execution via JSON Deserialization | HIGH 7.5 | 0.6 % | ||
| CVE-2026-23736 | < 1.4.1 | seroval Affected by Prototype Pollution via JSON Deserialization | CRITICAL 9.8 | 0.3 % |