CVE-2026-116583: CVE-2026-116583: Code Injection via TypedArray Constructor Property Spoofing in Seroval

#security #cve #cybersecurity

CVE-2026-116583: Code Injection via TypedArray Constructor Property Spoofing in Seroval

Vulnerability ID: CVE-2026-116583
CVSS Score: 5.3
Published: 2026-10-28

CVE-2026-116583 (GHSA-f86p-h4j2-7qgj) is a code injection and cross-site scripting (XSS) vulnerability in Seroval, a JavaScript object serialization library. In versions 1.6.0 prior to 1.6.11, Seroval derives the constructor name of a TypedArray directly from the current.constructor.name property expression during serialization. If an attacker supplies untrusted properties that are merged onto a TypedArray instance, an own constructor property overrides the prototype property and gets emitted unescaped after the new keyword in the generated JavaScript output. Evaluating or rendering this output in a browser or JavaScript runtime results in arbitrary code execution.

TL;DR

Seroval versions 1.6.0 through 1.6.10 trust current.constructor.name when serializing TypedArray instances into executable JavaScript. Defining an own constructor property with a malicious name attribute on a TypedArray causes Seroval to emit arbitrary JavaScript payloads into serialized output, resulting in XSS or remote code execution upon hydration or evaluation.

⚠️ Exploit Status: POC

Technical Details

Vulnerability Type: Code Injection / Cross-Site Scripting (CWE-94, CWE-79)
Affected Component: seroval TypedArray Serializer (createTypedArrayNode, createBigIntTypedArrayNode)
Attack Vector: Network (Via untrusted property assignment onto TypedArray)
CVSS v4.0 Score: 5.3 Medium (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N)
EPSS Score: 0.27% (18.91th percentile)
Impact: Arbitrary JavaScript execution in client browser (XSS) or deserializing runtime
Exploit Status: Proof-of-Concept available in repository regression tests
Patched Version: seroval@1.6.11 / seroval-plugins@1.6.11

Affected Systems

seroval (npm package)
seroval-plugins (npm package)
seroval: >= 1.6.0, < 1.6.11 (Fixed in: 1.6.11)
seroval-plugins: >= 1.6.0, < 1.6.11 (Fixed in: 1.6.11)

Code Analysis

Commit: 1313ebb

fix: name typed array constructors from the array's internal type

diff --git a/packages/seroval/src/core/base-primitives.ts b/packages/seroval/src/core/base-primitives.ts
index e07b55f..c2f30b2 100644
--- a/packages/seroval/src/core/base-primitives.ts
+++ b/packages/seroval/src/core/base-primitives.ts
@@ -52,6 +52,7 @@ import type {
   BigIntTypedArrayValue,
   TypedArrayValue,
 } from './utils/typed-array';
+import { getTypedArrayName } from './utils/typed-array';

 export function createNumberNode(
   value: number,
@@ -322,7 +323,7 @@ export function createTypedArrayNode(
     SerovalNodeType.TypedArray,
     id,
     NIL,
-    current.constructor.name,
+    getTypedArrayName(current),
     NIL,
     NIL,
     NIL,
@@ -346,7 +347,7 @@ export function createBigIntTypedArrayNode(
     SerovalNodeType.BigIntTypedArray,
     id,
     NIL,
-    current.constructor.name,
+    getTypedArrayName(current),
     NIL,
     NIL,
     NIL,

Exploit Details

GitHub: Official regression test suite demonstrating TypedArray constructor spoofing via Object.defineProperty.

Mitigation Strategies

Upgrade seroval and seroval-plugins packages to version 1.6.11 or newer.
Avoid merging or copying untrusted user-supplied properties onto TypedArray or ArrayBufferView instances.
Strip own constructor properties from TypedArray objects prior to serialization if running on a vulnerable version.
Prefer structured JSON serialization (toJSON / fromJSON) over raw JavaScript code evaluation (serialize / compileJSON) where executable hydration is not strictly required.

Remediation Steps:

Audit package-lock.json, pnpm-lock.yaml, or yarn.lock to identify direct or transitive dependencies on seroval versions >= 1.6.0 and < 1.6.11.
Run npm install seroval@^1.6.11 (or configure package overrides) to enforce installation of version 1.6.11 or higher.
Review application code for uses of Object.assign, Object.defineProperty, or deep-merge utilities acting on TypedArray instances prior to calling serialize, crossSerialize, or compileJSON.
Verify the fix by running automated regression tests ensuring TypedArrays with spoofed constructor properties serialize with their canonical type names.

References

Read the full report for CVE-2026-116583 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community