seroval.fromJSON() Promise resolver type confusion invokes attacker-controlled methods (CVE-2026-59940)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledpackages/seroval/src/core/context/deserializer.ts:591

   deserializePromiseResolve()

2. 1
   Step 01packages/seroval/src/index.ts:fromJSON()

   An application passes attacker-controlled Seroval JSON to fromJSON() with one or more deserialization plugins enabled. The payload controls both the serialized node tree and the top-level m list of reference IDs that vanilla mode retains.

   const result = fromJSON(payload, { plugins: [CallablePlugin] });
   

3. 2
   Step 02packages/seroval/src/core/context/deserializer.ts:assignIndexedValueVanilla()

   When an indexed object ID appears in m, vanilla deserialization stores that ordinary attacker-created value in the shared reference table. Ref ID 0 can therefore hold a plain object whose .s and .f properties are plugin-produced functions.

   if (ctx.state.marked.has(id)) {
     ctx.base.refs.set(id, value);
   }
   

4. 3
   Step 03packages/seroval/src/core/context/deserializer.ts:deserializePlugin()

   A registered plugin may legitimately deserialize a tagged node into a callable wrapper. The proof uses a harmless local plugin that returns functions which only append their arguments to an in-memory array.

   return assignIndexedValue(
     ctx,
     node.i,
     plugin.deserialize(node.s, new DeserializePluginContext(ctx, depth), {
       id: node.i,
     }),
   );
   

5. 4
   Step 04packages/seroval/src/core/context/deserializer.ts:deserializePromiseResolve() (before 1.5.3)

   The vulnerable Promise success handler retrieved refs[node.i] and checked only whether the value was truthy. It did not establish that the ref came from Seroval's internal Promise constructor path before calling .s().

   const deferred = ctx.base.refs.get(node.i);
   if (deferred) {
     deferred.s(deserialize(ctx, depth, node.a[1]));
     return NIL;
   }
   throw new SerovalMissingInstanceError("Promise");
   

6. 5
   Step 05packages/seroval/src/core/context/deserializer.ts:deserializePromiseReject() (before 1.5.3)

   The rejection handler made the same assumption and invoked .f() on the attacker-created ref. Both handlers passed a separately deserialized attacker-controlled value as the call argument.

   const deferred = ctx.base.refs.get(node.i);
   if (deferred) {
     deferred.f(deserialize(ctx, depth, node.a[1]));
     return NIL;
   }
   throw new SerovalMissingInstanceError("Promise");
   

7. 6
   Step 06packages/seroval/src/core/context/deserializer.ts:validateNodeType() (1.5.3 fix)

   The fixed deserializer records the node type associated with an internal Promise constructor ref and validates that provenance before either control node invokes a resolver callback. An ordinary object stored in the general ref table has no matching PromiseConstructor type and is rejected first.

   function validateNodeType(ctx, node, id, type) {
     if (ctx.base.refs.types.get(id) !== type) {
       throw new SerovalMalformedNodeError(node);
     }
   }
   
   validateNodeType(ctx, node, node.i, SerovalNodeType.PromiseConstructor);
   deferred.s(deserialize(ctx, depth, node.a[1]));
   

8. Sinkpackages/seroval/src/core/context/deserializer.ts:607

   deserializePromiseReject()