CVE-2026-59940: seroval fromJSON() Promise Resolver Type Confusion
A type confusion bug in seroval's JSON deserializer lets attacker-controlled input trick Promise control nodes into calling methods on arbitrary objects from the reference table, enabling unintended…
The problem
seroval's streaming JSON format stores serialized values in a shared reference table indexed by integer IDs. Before 1.5.3, Promise control nodes (the JSON nodes that resolve or reject a pending Promise) looked up their target by raw reference-table index without checking whether that entry was actually an internal promise resolver record.
An attacker who can send untrusted Seroval JSON to a server can place any value at a chosen reference-table index and then craft a Promise control node that targets that index. When plugins are registered and produce callable objects during deserialization, the resolver invocation becomes an attacker-directed method call on an arbitrary object.
In downstream frameworks like TanStack Start, this primitive was privately confirmed to enable unintended server-side function invocation, and depending on what callable wrappers are registered, the impact can reach remote code execution.
The fix
Upgrade to seroval@1.5.3 or later. As defense in depth, restrict accepted Seroval node types for inbound client payloads, allowlist plugin tags for untrusted deserialization paths, and avoid registering plugins that produce callable or privileged values unless strictly necessary.
Reported by Mufeed VH (Winfunc Research).
Related research
- highreact-router RSC Mode CSRF Bypass ()
- highCVE-2026-55607CVE-2026-55607: @anthropic-ai/claude-code Sandbox Escape via Git Worktree Path Confusion
- high · 7.5js-yaml: Exponential Parsing DoS via Nested Flow Collections
- high · 7.5CVE-2026-15074CVE-2026-15074: @fastify/static Route Guard Bypass via Dot-Dot Path Traversal