CVE-2026-59940 Overview
CVE-2026-59940 is an insecure deserialization vulnerability in Seroval, a JavaScript library that serializes complex JS values beyond the capabilities of JSON.stringify. Versions prior to 1.5.3 allow attacker-controlled JSON Promise control nodes to operate on values pulled from the general deserialization reference table. The seroval.fromJSON() function does not verify that referenced entries are genuine internal Promise resolver records. With plugins enabled, this triggers deserialization side effects and can lead to unintended server-side invocation or remote code execution when downstream frameworks register callable wrappers. The issue is fixed in version 1.5.3 and tracked under [CWE-502].
Critical Impact
Attackers can achieve remote code execution over the network without authentication by submitting crafted JSON to applications that call seroval.fromJSON() with plugins.
Affected Products
- Seroval versions prior to 1.5.3
- Applications invoking seroval.fromJSON() with plugins enabled
- Downstream frameworks that register callable wrappers on Seroval outputs
Discovery Timeline
- 2026-08-18 - CVE-2026-59940 published to NVD
- 2026-08-18 - Last updated in NVD database
Technical Details for CVE-2026-59940
Vulnerability Analysis
Seroval extends JSON serialization to support cyclic references, Promises, typed arrays, and other structures that native JSON cannot represent. To rebuild these structures, seroval.fromJSON() maintains a general reference table that maps node identifiers to reconstructed values. The library also recognizes control nodes that instruct the deserializer to resolve or reject Promises on referenced entries.
The flaw lies in the absence of type validation between control nodes and their targets. Promise control nodes accept any reference identifier and operate on the retrieved value as though it were a genuine internal Promise resolver record. Attackers control the JSON input, so they choose the identifiers and the values placed at those slots. This is a classic insecure deserialization pattern classified under [CWE-502].
Root Cause
The root cause is missing runtime type verification inside the Promise control-node handler. The deserializer trusts that any node referenced by a Promise control operation is an internal resolver record. Attackers exploit this trust to redirect Promise resolution logic onto arbitrary reconstructed objects. When Seroval plugins are enabled, plugin hooks execute during reconstruction, producing observable side effects. Downstream frameworks that wrap deserialized values in callable proxies then convert those side effects into function invocations.
Attack Vector
Exploitation requires network access to an endpoint that passes untrusted JSON to seroval.fromJSON(). The attacker crafts a payload containing Promise control nodes pointing at attacker-chosen reference entries. Deserialization triggers plugin logic and, in vulnerable framework integrations, invokes registered callable wrappers with attacker-influenced state. The result ranges from unintended server-side function invocation to full remote code execution depending on which plugins and wrappers are registered. No authentication or user interaction is required.
Refer to the GitHub Security Advisory GHSA-mv8w-475r-vwqw for the maintainer's technical write-up.
Detection Methods for CVE-2026-59940
Indicators of Compromise
- Inbound HTTP requests containing Seroval-formatted JSON with Promise control nodes referencing unusual identifiers.
- Unexpected Node.js child processes, outbound connections, or file writes originating from services that call seroval.fromJSON().
- Application error logs referencing Seroval plugin execution paths during request handling.
Detection Strategies
- Inventory all Node.js services and audit package.json and lockfiles for seroval versions below 1.5.3.
- Instrument application logs around seroval.fromJSON() calls to capture payload size, plugin activation, and caller context.
- Correlate web application firewall logs with process telemetry to identify deserialization requests that precede anomalous process activity.
Monitoring Recommendations
- Alert on Node.js processes spawning shells, package managers, or network utilities in production runtimes.
- Monitor outbound egress from application servers to unknown destinations following JSON POST requests.
- Track dependency changes in continuous integration pipelines to detect vulnerable seroval versions reintroduced through transitive dependencies.
How to Mitigate CVE-2026-59940
Immediate Actions Required
- Upgrade seroval to version 1.5.3 or later across all applications and transitive dependencies.
- Audit code paths that invoke seroval.fromJSON() with plugins enabled and confirm inputs originate from trusted sources.
- Review downstream framework integrations that wrap deserialized values in callable objects and restrict their scope.
Patch Information
The maintainer released Seroval 1.5.3, which validates that Promise control nodes operate only on genuine internal resolver records. See the GitHub Security Advisory GHSA-mv8w-475r-vwqw for the fix details and commit references.
Workarounds
- Disable Seroval plugins on any endpoint that deserializes untrusted input until the upgrade is complete.
- Terminate JSON deserialization requests at an authenticating reverse proxy so anonymous callers cannot reach vulnerable code paths.
- Enforce strict schema validation on JSON payloads before passing them to seroval.fromJSON() to reject unexpected control nodes.
# Upgrade Seroval to the patched release
npm install seroval@1.5.3
# Verify installed version across the dependency tree
npm ls seroval
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
