---
id: "CVE-2026-116582"
kind: "vulnerability"
aliases: ["CVE-2026-116582"]
title: "Seroval: RegExp serialization lets crafted input break out of script tags"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "node", "package", "seroval"]
not_affected_if: ["no-html-script-embedding", "no-user-built-regexp", "version-1.6.10-or-later"]
published_at: "2026-10-26T21:18:16+00:00"
first_seen_at: "2026-10-26T21:20:31+00:00"
updated_at: "2026-10-26T21:21:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116582", "first_seen_at": "2026-10-26T21:20:31+00:00"}]
---

# Seroval: RegExp serialization lets crafted input break out of script tags

Seroval serializes JavaScript values, and from 1.5.5 until 1.6.10 (and all versions before 1.0.0) it does not escape a less-than character in RegExp sources when the output is placed in an HTML script element. An attacker who controls regular expression text that the application serializes can end the script element and run JavaScript in another user's page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `seroval` version in the lockfile or with `npm ls seroval`.
- Search the codebase for calls to `serialize`, `serializeAsync`, `crossSerialize`, `crossSerializeAsync`, `crossSerializeStream`, `Serializer` or `compileJSON` that handle RegExp values built from user input and are embedded in a script tag.

## Fix

- Upgrade `seroval` to `1.6.10` or later.
- Until upgraded, do not build RegExp source from untrusted input that is serialized into HTML.

## Timeline

- 2026-10-26T21:20:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116582

## From the sources

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_