CVE-2026-104846: Seroval Promise Deserialization RCE Vulnerability

CVE-2026-104846 Overview

CVE-2026-104846 is a type confusion vulnerability in Seroval, a JavaScript library that serializes complex values beyond JSON.stringify capabilities. The flaw affects versions 0.12.0 through 1.6.1. Attackers can craft malicious JSON that, when passed to fromJSON, deserializes a fulfilled Promise control node containing a plugin-produced callable-bearing thenable. Native Promise resolver assimilation then invokes the attacker-controlled callable, enabling arbitrary code execution in applications that use plugin-capable Seroval releases. The flaw bypasses the earlier remediation for CVE-2026-59940 shipped in version 1.5.3. Maintainers resolved the issue in version 1.6.2.

Critical Impact

Attacker-controlled JSON passed to fromJSON can trigger arbitrary code execution through native Promise thenable assimilation, with no authentication or user interaction required.

Affected Products

• Seroval versions 0.12.0 through 1.6.1
• Applications using plugin-capable Seroval releases
• Downstream frameworks that call fromJSON on untrusted input

Discovery Timeline

• 2026-10-02 - CVE-2026-104846 published to NVD
• 2026-10-05 - Last updated in NVD database

Technical Details for CVE-2026-104846

Vulnerability Analysis

Seroval extends JSON serialization to support structures like Promises, Maps, Sets, and circular references. The library's fromJSON function reconstructs these values from a serialized form. The deserializer treats a fulfilled Promise control node by passing the referenced value directly to a native Promise resolver. When a plugin produces an object that is also a thenable, ECMAScript assimilation rules invoke its then method during Promise settlement. This weakness is categorized as Type Confusion [CWE-843].

The root issue is that the deserializer does not reject or sanitize thenable objects before handing them to the native Promise machinery. Version 1.5.3 addressed a related Promise resolver type-confusion flaw tracked as CVE-2026-59940, but the fix did not account for callable invocation occurring after deserialization through native settlement.

Root Cause

The deserializer in packages/seroval/src/core/context/deserializer.ts lacked a thenable check before resolving a fulfilled Promise node. Plugins can produce values with a callable then property. When passed to a native Promise.resolve, the engine calls that then function as part of thenable assimilation, executing attacker-chosen logic.

Attack Vector

An attacker supplies crafted JSON to any endpoint that deserializes untrusted input through Seroval fromJSON. The payload encodes a fulfilled Promise control node referencing a plugin-produced value whose then property is callable. Deserialization completes, native Promise settlement invokes the callable, and attacker code runs in the host process.

// Security patch in packages/seroval/src/core/context/deserializer.ts (v1.6.2)
function isThennable(value: unknown): boolean {
  return (
    !!value &&
    typeof value === 'object' &&
    'then' in value &&
    typeof value.then === 'function'
  );
}

function assignIndexedValueVanilla<T>(
  ctx: VanillaDeserializerContext,
  id: number,

Source: GitHub Commit f1ffcc9

The fix introduces an isThennable guard so the deserializer can detect and reject callable-bearing thenables before they reach native Promise resolution.

Detection Methods for CVE-2026-104846

Indicators of Compromise

• Unexpected outbound connections or child process creation from Node.js services that accept serialized input
• JSON payloads containing Seroval Promise control nodes referencing plugin-encoded objects with then properties
• Runtime errors or stack traces mentioning fromJSON, Promise resolution, or Seroval plugin handlers after processing external data

Detection Strategies

• Inventory applications and dependencies pulling seroval versions between 0.12.0 and 1.6.1 using Software Composition Analysis
• Inspect HTTP request bodies and message queue payloads routed to deserialization endpoints for Seroval wire-format markers
• Correlate Node.js process telemetry with inbound request logs to identify anomalous callable invocations following deserialization

Monitoring Recommendations

• Alert on new child processes, file writes, or network sockets spawned by processes that only serve API traffic
• Monitor npm audit output and GitHub Dependabot alerts referencing GHSA-p6vx-979v-rg4c
• Capture application logs around Seroval plugin registration and fromJSON call sites for post-incident analysis

How to Mitigate CVE-2026-104846

Immediate Actions Required

• Upgrade Seroval to version 1.6.2 or later across all services, including transitive dependencies
• Audit application code for calls to fromJSON that process untrusted or network-sourced data
• Rotate secrets and review audit logs on any host that may have deserialized untrusted Seroval payloads

Patch Information

The fix is available in Seroval 1.6.2. The patch adds an isThennable check in packages/seroval/src/core/context/deserializer.ts to prevent callable-bearing thenables from reaching native Promise settlement. Review the GitHub Security Advisory GHSA-p6vx-979v-rg4c and the upstream commit for the full change set.

Workarounds

• Disable or remove third-party Seroval plugins until the upgrade is complete, since the exploit path requires plugin-capable releases
• Restrict fromJSON to trusted serialized data only and reject payloads sourced from untrusted clients or message brokers
• Place deserialization logic behind strict input validation and authenticated channels where possible

# Upgrade Seroval to the fixed release
npm install seroval@^1.6.2

# Verify the resolved version in the dependency tree
npm ls seroval