IT SBIT Services
Schneeberger
DEEN
CVE tracker

Seroval: Code execution via Promise thenable assimilation in fromJSON()

CVE-2026-104846Critical 9.8

← All vulnerabilities

Summary

The npm package seroval (versions 0.12.0 up to 1.6.2) can invoke plugin-produced callables when fromJSON() deserializes a fulfilled Promise node. Native Promise handling calls the callable as a thenable, so attacker-controlled JSON can trigger code in applications that use plugin-capable Seroval releases. The flaw bypasses the earlier fix for CVE-2026-59940 in version 1.5.3. Exposure depends on whether untrusted input reaches Seroval's deserializer on a server, for example through SolidJS or TanStack Start server-side state serialization.

Affected

  • seroval >= 0.12.0 and < 1.6.2 (CVE record and OSV)
  • The GitHub advisory lists <= 1.6.0; VulDB lists up to 1.6.1
  • Transitive dependency in SolidJS and TanStack Router/Start setups is common
  • Also check seroval-plugins and nested copies in lockfiles

Fixed in

  • Fixed in seroval 1.6.2 (fix commit f1ffcc9)
  • Third-party reports indicate later 1.6.x releases fix further advisories; use the latest 1.6.x release and confirm in the GitHub advisory database

Workaround

Unknown. No vendor workaround is published; upgrading is the only stated remediation. Until patched, make sure untrusted JSON never reaches Seroval's fromJSON() function.

Exploitation

  • CVSS 9.8 (CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); network-reachable, no authentication, no user interaction
  • CISA SSVC: Exploitation none, Automatable yes, Technical Impact total
  • Not found in the CISA KEV catalogue in the research; verify directly
  • No public proof of concept found

Our recommendation

  • Inventory seroval in all lockfiles, including nested dependencies of solid-js, @tanstack/* and seroval-plugins
  • Upgrade to 1.6.2 at minimum, preferably the latest 1.6.x release
  • Where a direct upgrade is blocked, use a package-manager override and retest
  • Check whether untrusted client data reaches the deserializer on servers, and prioritise internet-facing applications
  • Monitor application logs for unusual deserialization errors until patched

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 21:25.

Original description (NVD)

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. From 0.12.0 until 1.6.2, fromJSON deserialization of a fulfilled Promise control node can pass a plugin-produced callable-bearing thenable to a native Promise resolver. ECMAScript thenable assimilation then invokes the callable unexpectedly, allowing attacker-controlled JSON to trigger code in applications using plugin-capable Seroval releases. This path bypasses the Promise resolver type-confusion remediation in version 1.5.3 for CVE-2026-59940 because the unexpected invocation occurs through native Promise settlement after the referenced value is deserialized. This issue is fixed in version 1.6.2.

NVD references (2)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed