[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
seroval (source)	1.6.8 → 1.6.11

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Seroval: Script injection through RegExp sources in serialized output

CVE-2026-116582 / GHSA-9wx9-5pv9-3349

More information

Details

Summary

seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.

Details

seroval escapes < in strings, so string values cannot end a <script> element. RegExp sources did not get the same escaping:

• Versions before 1.0.0 wrote the source as is.
• Version 1.5.5 stopped escaping < in RegExp sources, so that named groups and lookbehinds keep working. This removed the escaping for every < in a source.

These functions are affected:

• serialize, serializeAsync
• crossSerialize, crossSerializeAsync, crossSerializeStream
• the Serializer class
• compileJSON

toJSON, fromJSON, toCrossJSON and fromCrossJSON are not affected, because they never produce JavaScript.

Impact

An application is affected when all of these are true:

1. It builds a RegExp from untrusted input that is used as regular expression syntax. Input passed through an escaping helper (such as an escapeRegExp function) is not enough to exploit this.
2. It serializes that RegExp with one of the functions above.
3. It places the output inside an HTML <script> element, as server rendering usually does.

In that case an attacker can run script in the page of any user who receives that output.

Patches

Fixed in 1.6.10. A RegExp whose source contains < is now written with the RegExp constructor and an escaped string source. Named groups and lookbehinds keep working.

Workarounds

If you cannot upgrade:

• Do not serialize a RegExp built from untrusted pattern syntax. Send its source and flags as strings, and build the RegExp on the client.
• Or reject patterns that contain < before they reach the serializer.

Severity

• CVSS Score: 4.7 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

References

• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-9wx9-5pv9-3349
• https://nvd.nist.gov/vuln/detail/CVE-2026-116582
• https://github.com/lxsmnsyc/seroval/commit/f94ee0b63936dae954ff50d5b5e8ea7cb9b284e6
• https://github.com/lxsmnsyc/seroval
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.10

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Seroval: Code injection through a typed array's own constructor property

CVE-2026-116583 / GHSA-f86p-h4j2-7qgj

More information

Details

Summary

seroval writes a typed array as a call to its constructor. In affected versions, the constructor name in the output is read from a property that data on the value can replace, and it is written without checks. A typed array that received properties from untrusted data can then put arbitrary code into the serialized output.

Details

Version 1.6.0 changed how seroval finds the class of an object, so that objects with their own constructor property serialize correctly. Typed arrays still took the constructor name from the value itself, so the name could come from the untrusted property instead of the array's real type.

These functions are affected:

• serialize, serializeAsync
• crossSerialize, crossSerializeAsync, crossSerializeStream
• the Serializer class
• compileJSON

fromJSON and fromCrossJSON are not affected: they only accept the names of the built-in typed arrays. With the compactArrayBufferViews option, the same lookup throws a TypeError instead of writing code.

Impact

An application is affected only when it serializes a typed array that has an own constructor property set from untrusted data. That requires code that copies properties from untrusted objects onto a typed array. This is unusual, so the severity is rated Low, even though the result is script execution in the page that receives the output.

Patches

Fixed in 1.6.11. The constructor name now comes from the array's internal type, which properties on the value cannot change. compactArrayBufferViews uses the real type as well.

Workarounds

If you cannot upgrade, do not copy properties from untrusted objects onto typed arrays, or remove an own constructor property from a typed array before serializing it.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N

References

• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-f86p-h4j2-7qgj
• https://nvd.nist.gov/vuln/detail/CVE-2026-116583
• https://github.com/lxsmnsyc/seroval/commit/1313ebbad9687bc0245e08bfd576376e57e0e5c1
• https://github.com/lxsmnsyc/seroval
• https://github.com/lxsmnsyc/seroval/releases/tag/seroval@1.6.11

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

lxsmnsyc/seroval (seroval)

v1.6.11

Compare Source

v1.6.10

Compare Source

v1.6.9

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Zurich)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[yannickmonney]

Landed on train as 8505d7e (squashed from head e5e8736). It reaches main with the next train pull request.

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (1.6.11). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.