npm / PACKAGE INTELLIGENCE

seroval

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

Stringify JS values

Latest release1.7.3

Declared licenseMIT

Listed maintainerslxsmnsyc, schiller-manuel

Runtime dependencies0

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataRecorded, not verified here

Registry deprecationNot marked deprecated

Fetched 29/10/2026, 03:08:29 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high7.5

CVE-2026-116584Fix available

Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length

npm / seroval

26 Oct 2026

seroval npm

Affected range	Recorded fix
From 1.4.1 before 1.6.8Semantic versions	1.6.8

Version evidence: OSV · GHSA-wp97-x4hv-qvhp

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.4.1"
        },
        {
          "fixed": "1.6.8"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium5.3

CVE-2026-116583Fix available

Seroval: Code injection through a typed array's own constructor property

npm / seroval

26 Oct 2026

seroval npm

Affected range	Recorded fix
From 1.6.0 before 1.6.11Semantic versions	1.6.11

Version evidence: OSV · GHSA-f86p-h4j2-7qgj

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.6.0"
        },
        {
          "fixed": "1.6.11"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

medium4.7

CVE-2026-116582Fix available

Seroval: Script injection through RegExp sources in serialized output

npm / seroval

26 Oct 2026

seroval npm

Affected range	Recorded fix
From 1.5.5 before 1.6.10Semantic versions	1.6.10

Version evidence: OSV · GHSA-9wx9-5pv9-3349

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "1.5.5"
        },
        {
          "fixed": "1.6.10"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

seroval npm

Affected range	Recorded fix
Earlier releases before 1.0.0Semantic versions	1.0.0

Version evidence: OSV · GHSA-9wx9-5pv9-3349

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.0.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.5

CVE-2026-116581Fix available

Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)

npm / seroval

26 Oct 2026

seroval npm

Affected range	Recorded fix
Earlier releases before 1.6.8Semantic versions	1.6.8

Version evidence: OSV · GHSA-97r2-qh9m-474h

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.6.8"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.3

CVE-2026-116580Fix available

Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check

npm / seroval

26 Oct 2026

seroval npm

Affected range	Recorded fix
Earlier releases before 1.6.8Semantic versions	1.6.8

Version evidence: OSV · GHSA-7rv5-mrxv-xcr9

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "1.6.8"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}