CVE-2026-104846: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Seroval, the npm JavaScript serializer, lets an attacker trigger a plugin-produced callable when an application runs `fromJSON()` on crafted input. The flaw bypasses the earlier 1.5.3 type-confusion fix. Every plugin-capable release from 0.12.0 through 1.6.0 is affected. Upgrade to 1.6.2.
Published Oct 5, 2026 · Analysis Oct 25, 2026
What an attacker can do
fromJSON() rebuilds objects from serialized nodes. A fulfilled Promise node can carry a value that is a thenable, an object with a callable then. When the Promise resolves with it, native ECMAScript thenable assimilation calls that then automatically. If a plugin produced the callable, the deserializer runs it without the application asking for it.
This defeats the fix shipped in 1.5.3 for GHSA-mv8w-475r-vwqw (CVE-2026-59940), which is why this is a bypass.
The attacker needs only a way to send serialized data to code that calls fromJSON(). That is typical for server functions, RPC layers and framework state transfer. No privileges and no user interaction are needed. The CVSS vector is network, low complexity, with high impact on confidentiality, integrity and availability. The advisory does not say which callables can be reached, so the real impact depends on which plugins your app registers.
Who is affected
Seroval from 0.12.0 up to and including 1.6.0, the range that supports plugins. You are exposed if your application, or a framework you use, calls fromJSON() on data an outside party can influence. Seroval is often a transitive dependency, so check the full tree.
npm ls serovalseroval
- Ecosystem
- npm
- Affected
- >= 0.12.0, <= 1.6.0
- Fixed in
- 1.6.2
- Check
npm ls seroval
How to fix it
Upgrade to seroval 1.6.2.
npm install [email protected]The fix is in the deserializer. It adds a check for thenables, and a Promise node whose value is thenable now throws SerovalMalformedNodeError. The advisory lists no workaround. For transitive copies, update the parent package or use your package manager's override feature to force 1.6.2.
How to tell if you were hit
Look for SerovalMalformedNodeError in application logs after upgrading. It marks input that the new guard rejected, and it can point to attempted exploitation. On vulnerable versions there is no specific log line. Review endpoints that pass request bodies to fromJSON(), and check for unexpected behavior from the plugins you register.
Original advisory
From the GitHub Advisory Database (CC BY 4.0).
A fulfilled Promise node deserialized by fromJSON() can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from 0.12.0 through the current 1.6.0.
Credited to Sicks3c.
Questions
- Is the earlier seroval 1.5.3 fix enough?
No. This issue bypasses the 1.5.3 type-confusion fix for CVE-2026-59940. Releases through 1.6.0 remain affected. Upgrade to 1.6.2.
- Does exploitation need authentication or user interaction?
No. The advisory rates it network-reachable with no privileges and no user interaction. The application only has to call
fromJSON()on attacker-influenced input.- Is CVE-2026-104846 exploited in the wild?
None of the sources read say so, and it is not in CISA's KEV catalog. The advisory includes no proof of concept.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. The analysis is written by an AI model from the sources listed above and checked by automated rules before it is published. Check versions against the vendor's advisory before you act. Methodology