What’s Vulnerable › Products

lxsmnsyc seroval vulnerabilities

13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 13 published in the last 12 months.

Check whether your lxsmnsyc seroval version is affected

Latest lxsmnsyc seroval vulnerabilities

• CVE-2026-116584 — Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length (CVSS 7.5)
• CVE-2026-116583 — Seroval: Code injection through a typed array's own constructor property (CVSS 5.3)
• CVE-2026-116582 — Seroval: Script injection through RegExp sources in serialized output (CVSS 4.7)
• CVE-2026-116581 — Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) (CVSS 7.5)
• CVE-2026-116580 — Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check (CVSS 7.3)
• CVE-2026-104846 — Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) (CVSS 9.8)
• CVE-2026-104845 — Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization (CVSS 7.5)
• CVE-2026-59940 — Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization (CVSS 9.8)
• CVE-2026-24006 — Seroval affected by Denial of Service via Deeply Nested Objects (CVSS 7.5)
• CVE-2026-23957 — seroval is vulnerable to Denial of Service via array serialization (CVSS 7.5)
• CVE-2026-23956 — seroval affected by Denial of Service via RegExp serialization (CVSS 7.5)
• CVE-2026-23737 — seroval Affected by Remote Code Execution via JSON Deserialization (CVSS 7.5)
• CVE-2026-23736 — seroval Affected by Prototype Pollution via JSON Deserialization (CVSS 9.8)