{"id":"EUVD-2026-110242","enisaUuid":"ee492a71-2ed7-3029-b1cd-dd9ae555889b","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.","datePublished":"Oct 26, 2026, 8:35:49 PM","dateUpdated":"Oct 26, 2026, 8:35:49 PM","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9\nhttps://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2\nhttps://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8\n","aliases":"CVE-2026-116580\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"44a677de-22ed-322d-be5a-b51f4d5e6f94","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"\u003c 1.6.8"}],"enisaIdVendor":[{"id":"08cd9d40-c4a0-329c-bdb1-943b2464bc6e","vendor":{"name":"lxsmnsyc"}}],"enisaIdVulnerability":[{"id":"df050006-e157-3456-9c9e-861bfaf753d1","vulnerability":{"id":"CVE-2026-116580","description":"Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.","datePublished":"Oct 26, 2026, 8:35:49 PM","dateUpdated":"Oct 26, 2026, 8:35:49 PM","status":"PUBLISHED","baseScore":7.3,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","references":"https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-7rv5-mrxv-xcr9\nhttps://github.com/lxsmnsyc/seroval/commit/3edc78b495ea0d6bd498143e5b3e56996607c5f2\nhttps://github.com/lxsmnsyc/seroval/commit/50926b3ee198fb757e6ce3aa70efeed38d931c8d\nhttps://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.8\n","enisa_id":"EUVD-2026-110242\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Oct 28, 2026, 11:01:00 PM","vulnerabilityProduct":[{"id":"da441688-5b05-3854-8536-ab27bb84f372","product":{"name":"seroval","vendor":{"name":"lxsmnsyc"}},"product_version":"\u003c 1.6.8"}],"vulnerabilityVendor":[{"id":"9905d4a0-e04a-31c9-abd9-c2f734c89de2","vendor":{"name":"lxsmnsyc"}}]}}],"enisaIdAdvisory":[]}