~ / search / GHSA-p6vx-979v-rg4c

GHSA-p6vx-979v-rg4c

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-104846

Packages

EcosystemPackageAffectedFixed in
npm seroval >= 0.12.0, < 1.6.2 1.6.2

Details

As written in the advisory (Markdown source, shown as plain text).

A fulfilled Promise node deserialized by `fromJSON()` can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in `[email protected]` (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from `0.12.0` through the current `1.6.0`.

References

External links from the advisory. They lead to third-party sites.