What’s Vulnerable › Vulnerabilities

CVE-2026-116583: Seroval: Code injection through a typed array's own constructor property

• Severity: medium (CVSS 5.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-26 · updated 2026-10-27
• Weakness: CWE-79

Description

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.

Affected products

• lxsmnsyc seroval: from 1.6.0, < 1.6.11

References

• https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj

Get alerted when CVE-2026-116583 or the next vulnerability affects your stack