CVE-2026-116582: Seroval: Script injection through RegExp sources in serialized output

Q: Which applications are actually exposed to this issue?

An application is affected only if it creates regular expression syntax from untrusted input, serializes that RegExp using one of the affected JavaScript-output APIs, and places the serialized result inside an HTML script element. Applications that do not embed this output in a script element do not meet the described attack condition.

Q: What must an attacker be able to do to exploit it?

The attacker must be able to influence input used to construct a RegExp source containing a less-than character. The application must then serialize that RegExp and return the resulting script-containing page to another user, where the crafted source can terminate the script element and execute code.

Q: Are default uses of Seroval affected?

The issue is not described as affecting every Seroval use. Exposure depends on the specific combination of untrusted RegExp construction, an affected JavaScript-output serialization API, and embedding the output in an HTML script element.

Q: Which APIs should be reviewed while patching is pending?

Review uses of serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, and compileJSON where their output is inserted into HTML script elements. As an interim mitigation, avoid constructing serialized RegExp values from untrusted input for those script contexts.

Q: What version fixes the issue?

Version 1.6.10 fixes the issue. The affected ranges are versions prior to 1.0.0 and versions from 1.5.5 through 1.6.9.

Published Oct 26, 2026

Updated

Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. Prior to 1.0.0 and from 1.5.5 until 1.6.10, the JavaScript-output APIs serialize a RegExp source containing a less-than character without the escaping needed for an HTML script element. An application is affected when it builds regular expression syntax from untrusted input, serializes that RegExp through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON, and embeds the result in an HTML script element. The crafted source can terminate the element and execute script in the page received by another user. This issue is fixed in version 1.6.10.

Affected Software

3 affected componentsFixes available

npm/seroval<1.0.0, >=1.5.5<1.6.10

npm/seroval<1.0.0

1.0.0

npm/seroval>=1.5.5<1.6.10

1.6.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade npm/seroval to a version that resolves this vulnerability.
Fixed in 1.0.0
Upgrade
Upgrade npm/seroval to a version that resolves this vulnerability.
Fixed in 1.6.10
Upgrade
Upgrade Seroval to a version that resolves this vulnerability.
Fixed in 1.6.10
Compensating control
Do not serialize a RegExp built from untrusted pattern syntax through serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, or compileJSON.
Compensating control
Reject regular-expression patterns containing '<' before they reach the serializer.
Compensating control
Send the RegExp source and flags as strings and build the RegExp on the client instead of serializing the RegExp.

Event History

Oct 26, 2026

CVE Published

via MITRE·08:46 PM

Data Sourced

via MITRE·08:46 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are actually exposed to this issue?

An application is affected only if it creates regular expression syntax from untrusted input, serializes that RegExp using one of the affected JavaScript-output APIs, and places the serialized result inside an HTML script element. Applications that do not embed this output in a script element do not meet the described attack condition.

What must an attacker be able to do to exploit it?

The attacker must be able to influence input used to construct a RegExp source containing a less-than character. The application must then serialize that RegExp and return the resulting script-containing page to another user, where the crafted source can terminate the script element and execute code.

Are default uses of Seroval affected?

The issue is not described as affecting every Seroval use. Exposure depends on the specific combination of untrusted RegExp construction, an affected JavaScript-output serialization API, and embedding the output in an HTML script element.

Which APIs should be reviewed while patching is pending?

Review uses of serialize, serializeAsync, crossSerialize, crossSerializeAsync, crossSerializeStream, Serializer, and compileJSON where their output is inserted into HTML script elements. As an interim mitigation, avoid constructing serialized RegExp values from untrusted input for those script contexts.

What version fixes the issue?

Version 1.6.10 fixes the issue. The affected ranges are versions prior to 1.0.0 and versions from 1.5.5 through 1.6.9.

CVE-2026-116582: Seroval: Script injection through RegExp sources in serialized output

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are actually exposed to this issue?

What must an attacker be able to do to exploit it?

Are default uses of Seroval affected?

Which APIs should be reviewed while patching is pending?

What version fixes the issue?

Company

Resources

Contact

Frequently Asked Questions

Which applications are actually exposed to this issue?

What must an attacker be able to do to exploit it?

Are default uses of Seroval affected?

Which APIs should be reviewed while patching is pending?

What version fixes the issue?