lxsmnsyc seroval

• CVE-2026-116584 High 7.5 Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length 0.4%
• CVE-2026-116583 Medium 5.3 Seroval: Code injection through a typed array's own constructor property 0.3%
• CVE-2026-116582 Medium 4.7 Seroval: Script injection through RegExp sources in serialized output 0.2%
• CVE-2026-116581 High 7.5 Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS) 0.5%
• CVE-2026-116580 High 7.3 Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check 0.3%
• CVE-2026-104846 Critical 9.8 Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940) 0.3%
• CVE-2026-104845 High 7.5 Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization 0.4%
• CVE-2026-59940 Critical 9.8 Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization 0.8%
• CVE-2026-24006 High 7.5 Seroval affected by Denial of Service via Deeply Nested Objects 0.4%
• CVE-2026-23957 High 7.5 seroval is vulnerable to Denial of Service via array serialization 0.4%
• CVE-2026-23956 High 7.5 seroval affected by Denial of Service via RegExp serialization 0.5%
• CVE-2026-23737 High 7.5 seroval Affected by Remote Code Execution via JSON Deserialization 0.6%
• CVE-2026-23736 High 7.3 seroval Affected by Prototype Pollution via JSON Deserialization 0.3%