seroval@1.0.0
Skip this version — install 1.7.1 instead.
8 known advisories (worst: critical), fixed in 1.6.3.
Why this verdict
- 8 known advisories (worst: critical), fixed in 1.6.3.Evidence
- New major version after 0.15.1: expect breaking changes.Evidence
Confidence 100% · algorithm v1 · computed 2026-10-23. How verdicts work
Supply chain and security
- Malware reports
- None known (OSV)
- Known advisories
- 8 known
- License
- MIT
- Install scripts
- None
- Build provenance
- No provenance
- Weekly downloads
- 97
- GHSA-3j22-8qj3-26mxSeroval affected by Denial of Service via Deeply Nested Objects
- GHSA-3rxj-6cgf-8cfwseroval Affected by Remote Code Execution via JSON Deserialization
- GHSA-66fc-rw6m-c2q6Seroval affected by Denial of Service via Array serialization
- GHSA-hj76-42vx-jwp4seroval Affected by Prototype Pollution via JSON Deserialization
- GHSA-hx9m-jf43-8ffrseroval affected by Denial of Service via RegExp serialization
- GHSA-jp82-f5mq-hwhpSeroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization
- GHSA-mv8w-475r-vwqwseroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
- GHSA-p6vx-979v-rg4cSeroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)
Compatibility
New major version after 0.15.1: expect breaking changes.
Check the official release notes below for behaviour changes before merging.
Release notes
Read the package page on npm for this version’s features and fixes.
Deprecations and deadlines
The maintainer has not deprecated this version on npm.