CVE-2026-116583: Seroval: Code injection through a typed array's own constructor property

October 28, 2026

seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.

References

github.com/advisories/GHSA-f86p-h4j2-7qgj
github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11
github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
nvd.nist.gov/vuln/detail/CVE-2026-116583

Code Behaviors & Features

Detect and mitigate CVE-2026-116583 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →