CVE-2026-116583 Seroval: Code injection through a typed array's own constructor property
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-116583?
CVE-2026-116583 is a medium-severity vulnerability in lxsmnsyc seroval, published on 26 Oct 2026.
Official description
Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. From 1.6.0 until 1.6.11, the JavaScript-output APIs derive a typed array's constructor name from a property on the value that can be replaced by an own constructor property. When application code copies untrusted properties onto a typed array and then passes it to serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, the attacker-controlled name is written as executable JavaScript and can run in the page receiving the output. This issue is fixed in version 1.6.11.
Which versions are affected by CVE-2026-116583?
2 open source packages ship an affected version, including seroval.
| Package | Affected | Fixed in |
|---|---|---|
seroval npm | From 1.6.0 | 1.6.11 |
seroval npm | From 1.6.0 | 1.6.11 |
How do I fix CVE-2026-116583?
Upgrade seroval to 1.6.11 or later.
Is CVE-2026-116583 being exploited?
There is no known exploitation of CVE-2026-116583 in the wild and no public exploit code.
Sources
Also known as GHSA-f86p-h4j2-7qgj.