Repository navigation
chore(deps): update dependency seroval to v1.6.3 [security] - #2247
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Contributor
|
Size Change: 0 B Total Size: 220 kB ℹ️ View Unchanged
|
More templates
@tanstack/angular-db
@tanstack/browser-db-sqlite-persistence
@tanstack/capacitor-db-sqlite-persistence
@tanstack/cloudflare-durable-objects-db-sqlite-persistence
@tanstack/db
@tanstack/db-ivm
@tanstack/db-sqlite-persistence-core
@tanstack/electric-db-collection
@tanstack/electron-db-sqlite-persistence
@tanstack/expo-db-sqlite-persistence
@tanstack/node-db-sqlite-persistence
@tanstack/offline-transactions
@tanstack/powersync-db-collection
@tanstack/query-db-collection
@tanstack/react-db
@tanstack/react-native-db-sqlite-persistence
@tanstack/react-router-with-db
@tanstack/rxdb-db-collection
@tanstack/solid-db
@tanstack/svelte-db
@tanstack/tauri-db-sqlite-persistence
@tanstack/trailbase-db-collection
@tanstack/vue-db
commit: |
renovate
Bot
force-pushed
the
renovate/npm-seroval-vulnerability
branch
from
October 25, 2026 05:26
3698957 to
c94137a
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.5.3→1.6.3seroval Affected by Prototype Pollution via JSON Deserialization
CVE-2026-23736 / GHSA-hj76-42vx-jwp4
More information
Details
Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.
This affects only JSON deserialization functionality.
As there is no known workaround, please upgrade to the latest version.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
seroval Affected by Remote Code Execution via JSON Deserialization
CVE-2026-23737 / GHSA-3rxj-6cgf-8cfw
More information
Details
Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.
The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation. This requires at least the ability to perform 4 separate requests on the same function and partial knowledge of how the serialized data is used during later runtime processing.
This vulnerability affects the
fromJSONandfromCrossJSONfunctions in a client-to-server transmission scenario.No known workarounds or mitigations are known, so please upgrade to the patched version.
Severity
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Seroval affected by Denial of Service via Array serialization
CVE-2026-23957 / GHSA-66fc-rw6m-c2q6
More information
Details
Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.
Mitigation:
Serovalno longer encodes array lengths.Instead, it computes length using
Array.prototype.lengthduring deserialization.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Seroval affected by Denial of Service via Deeply Nested Objects
CVE-2026-24006 / GHSA-3j22-8qj3-26mx
More information
Details
Serialization of objects with extreme depth can exceed the maximum call stack limit.
Mitigation:
Serovalintroduces adepthLimitparameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
seroval affected by Denial of Service via RegExp serialization
CVE-2026-23956 / GHSA-hx9m-jf43-8ffr
More information
Details
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation:
SerovalintroducesdisabledFeatures(a bitmask) in serialization/deserialization methods, withFeature.RegExpas a dedicated flag. Users are recommended to configuredisabledFeaturesto disable RegExp serialization entirely.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
seroval:
seroval.fromJSON()Promise resolver type confusion invokes attacker-controlled methods during deserializationCVE-2026-59940 / GHSA-mv8w-475r-vwqw
More information
Details
Summary
A type confusion issue in
seroval.fromJSON()allowed attacker-controlled JSON input to cause Promise control nodes to operate on values from the general deserialization reference table without first verifying that those values were genuine internal promise resolver records.In applications that deserialize untrusted Seroval JSON with plugins enabled, this could allow attacker-controlled deserialization side effects. In downstream server frameworks that register plugins returning callable wrappers, this primitive could become unintended server-side invocation and, depending on exposed application functionality, remote code execution or equivalent server compromise.
The issue was fixed in
seroval@1.5.3.Affected package
serovalfromJSON()1.5.3that contain the vulnerable Promise resolver reference handling1.5.3Impact
The vulnerable deserialization path could confuse attacker-created values in the general reference table with Seroval's internal promise resolver records.
Direct impact in
serovalis a deserialization side-effect primitive when untrusted JSON is deserialized with plugins enabled. Downstream impact depends on registered plugins and framework usage. If a downstream framework registers plugins that deserialize sensitive callable wrappers, attacker-controlled input may be able to trigger unintended server-side invocation during deserialization.A concrete downstream impact scenario was validated privately against TanStack Start before the
1.5.3fix. Withseroval@1.5.3, the downstream reproducer no longer succeeds.Remediation
Upgrade to
seroval@1.5.3or later.Downstream projects that accept Seroval JSON from untrusted clients should also consider defense-in-depth controls:
Fix verification
The original private reproducer was verified against
seroval@1.5.2and no longer reproduces againstseroval@1.5.3.Validation results:
seroval@1.5.2: vulnerable behavior reproduced.seroval@1.5.3: deserialization aborts before the attacker-controlled side effect occurs.seroval@1.5.3: no evidence side effect is produced.Credit
Reported by Mufeed VH from Winfunc Research.
Disclosure / coordination note
The downstream TanStack Start impact was coordinated privately. Technical exploit details and proof-of-concept reproduction material have been omitted from this advisory draft for discretion.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
CVE-2026-104845 / GHSA-jp82-f5mq-hwhp
More information
Details
Summary
deserializeTypedArray casts the source node to ArrayBuffer without checking it and never bounds the element count. Pass a plain object with a length property and it hits the array-like TypedArray constructor, allocating that many elements. The offset guard above it can't stop this: source.byteLength is undefined, so the comparison is always false.
The length is one integer in the JSON, so a tiny payload can name any allocation size, and it runs synchronously inside fromJSON, starving the event loop instead of just slowing one request. fromCrossJSON is the same.
Impact is unauthenticated CPU/memory exhaustion for any service deserializing untrusted Seroval JSON: same profile as the array-length and nested-depth DoS issues already fixed here. No confidentiality or integrity impact. DataView has the same unchecked cast but throws instead of allocating. A runtime instanceof ArrayBuffer check plus a size cap should fix it.
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Seroval:
fromJSON()Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)CVE-2026-104846 / GHSA-p6vx-979v-rg4c
More information
Details
A fulfilled Promise node deserialized by
fromJSON()can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix inseroval@1.5.3(GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from0.12.0through the current1.6.0.Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
lxsmnsyc/seroval (seroval)
v1.6.2Compare Source
v1.6.1Compare Source
v1.6.0Compare Source
v1.5.6Compare Source
v1.5.5: 1.5.5Credits to @spokodev and @greymoth-jp
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.