seroval vulnerabilities and fixes
Exploited and high-severity seroval vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 7.5CVE-2026-116581Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)Fix availableseroval
1 min read - 7.5CVE-2026-116584Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node lengthFix availableseroval
1 min read - 7.3CVE-2026-116580Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type checkRCEFix availableseroval
2 min read