Access of Resource Using Incompatible Type ('Type Confusion') Affecting seroval package, versions <1.5.3
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applicationsSnyk Learn
Learn about Access of Resource Using Incompatible Type ('Type Confusion') vulnerabilities in an interactive lesson.
Start learning- Snyk IDSNYK-JS-SEROVAL-18313050
- published26 Jul 2026
- disclosed24 Jul 2026
- creditmufeedvh
Introduced: 24 Jul 2026
NewCVE-2026-59940 (opens in a new tab)How to fix?
Upgrade seroval to version 1.5.3 or higher.
Overview
seroval is a Stringify JS values
Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type ('Type Confusion') in the fromJSON process. An attacker can achieve unintended server-side invocation and potentially execute arbitrary code by supplying specially crafted JSON input that manipulates the deserialization reference table when plugins are enabled. This is only exploitable if untrusted Seroval JSON is deserialized with plugins enabled and downstream frameworks register plugins that return callable wrappers.