Skip to content
Threat Feed
Subscribe

Product

TanStack Start

1 brief RSS
critical advisory

Seroval Type Confusion Vulnerability in fromJSON() Leads to Deserialization RCE

A critical type confusion vulnerability, CVE-2026-59940, in `seroval.fromJSON()` versions prior to 1.5.3 allows attackers to provide malicious JSON input that misleads Promise control nodes into operating on attacker-controlled values, potentially leading to arbitrary method invocation and remote code execution or server compromise in downstream server frameworks like TanStack Start that deserialize untrusted input with plugins enabled.

seroval +1 type-confusion deserialization rce npm ghsa
2t