---
id: "CVE-2026-116580"
kind: "vulnerability"
aliases: ["CVE-2026-116580"]
title: "Seroval: crafted input can invoke plugin-produced values during deserialization"
severity: "high"
cvss: 7.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node", "package", "seroval", "server-side"]
not_affected_if: ["no-custom-plugins", "trusted-input-only"]
published_at: "2026-10-26T21:18:15+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116580", "first_seen_at": "2026-10-26T21:20:31+00:00"}]
---

# Seroval: crafted input can invoke plugin-produced values during deserialization

Seroval is a JavaScript serializer that can rebuild complex values from text. Before version 1.6.8, a crafted input can make the deserializer call a value that an application plugin produced, so the impact depends on what that plugin exposes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `npm ls seroval` to list every installed Seroval version in the project
- Check whether the application registers custom Seroval plugins that return callable values or objects with an `on` method
- Check whether untrusted input reaches Seroval's `fromJSON` or deserialization path

## Fix

- Upgrade Seroval to `1.6.8` or later
- Rebuild and redeploy the application after updating the dependency

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116580

## From the sources

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.6.8, fromJSON rebuilds an AsyncIteratorFactoryInstance by calling source.on(listener) without requiring source to be a genuine internal stream. With untrusted Seroval input and an application plugin that returns a callable value or an object exposing an on method, a crafted node can reuse an identifier so the deserializer invokes the plugin-produced value. This is an incomplete-fix variant of CVE-2026-59940. The resulting confidentiality, integrity, or availability impact depends on the behavior exposed by the application plugin. This issue is fixed in version 1.6.8.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_