CVE-2026-59940

Name of the Vulnerable Software and Affected Versions seroval versions prior to 1.5.3

Description A type confusion issue exists in the fromJSON() function. This flaw allows attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without verifying if those values are genuine internal promise resolver records. In applications that deserialize untrusted Seroval JSON with plugins enabled, this can lead to deserialization side effects. In server frameworks that register plugins returning callable wrappers, this may result in unintended server-side invocation, potentially leading to remote code execution or server compromise.

Recommendations Upgrade to version 1.5.3 or later. Restrict accepted Seroval node types for client-to-server payloads. Allowlist plugin tags for inbound deserialization. Avoid registering plugins that produce callable or privileged values for untrusted inputs unless strictly necessary. Add regression tests to ensure deserialization cannot cause unintended server-side invocation.