CVE-2026-59940Disclosure

🚨Critical - seroval fromJSON() Promise Resolver Type Confusion (CVE-2026-59940) A type-confusion flaw in seroval.fromJSON() let attacker-controlled JSON make Promise control nodes operate on values from the general deserialization reference table without verifying they were genuine internal promise-resolver records. In apps that deserialize untrusted Seroval JSON with plugins enabled, this becomes an attacker-controlled deserialization side-effect primitive. In server frameworks whose plugins return callable wrappers, it can escalate to unintended server-side invocation and remote code execution - a downstream RCE-class impact was privately validated against TanStack Start. seroval underpins SolidJS and TanStack Start serialization. CVSS 9.8. 👉Upgrade seroval to 1.5.3. Defense-in-depth: restrict accepted node types and allowlist plugin tags for client-to-server payloads.