Changes.Watch~ upgrade verdicts ~
Free digest
CriticalPHP2Shell: is your PHP patched?

critical vulnerability

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

Fix availableCritical · CVSS 9.8EPSS 0.34%

Published Oct 5, 2026 · updated Oct 5, 2026

What to do

  1. Upgrade to a fixed version: seroval 1.6.2.
  2. Redeploy and restart long-running processes so they load the fixed code.

Affected packages

npmseroval

Vulnerable versions
>= 0.12.0, <= 1.6.0
Fixed in
1.6.2

Check your project: npm ls seroval --all

Is seroval@1.6.2 safe to install? See the upgrade verdict →

Sources

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

← All critical vulnerabilities