CVE-2026-116582 is a medium-severity (CVSS 4.7) Cross-site Scripting (XSS) vulnerability in seroval. A fix is available for seroval — see the affected versions and patch details below.
Seroval: Script injection through RegExp sources in serialized output
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2026-116582 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.
Where this sits among everything scored
Of 397,508 CVEs with a current EPSS score, this one falls in the < 10% band (highlighted). Counts from FIRST.org, log-scaled.
Real-World Exposure
How broadly this vulnerability is actually deployed: weekly install volume shows current usage, and reverse-dependency count shows how many other packages break if it stays unpatched.
serovalnpmDescription
Summary
seroval writes a RegExp as a regular expression literal. In affected versions, the < character in a RegExp source is written without escaping. A source built from untrusted input can then end the HTML <script> element that the serialized output is placed in, and run script in the page.
Details
seroval escapes < in strings, so string values cannot end a <script> element. RegExp sources did not get the same escaping:
- Versions before 1.0.0 wrote the source as is.
- Version 1.5.5 stopped escaping
<inRegExpsources, so that named groups and lookbehinds keep working. This removed the escaping for every<in a source.
These functions are affected:
serialize,serializeAsynccrossSerialize,crossSerializeAsync,crossSerializeStream- the
Serializerclass compileJSON
toJSON, fromJSON, toCrossJSON and fromCrossJSON are not affected, because they never produce JavaScript.
Impact
An application is affected when all of these are true:
- It builds a
RegExpfrom untrusted input that is used as regular expression syntax. Input passed through an escaping helper (such as anescapeRegExpfunction) is not enough to exploit this. - It serializes that
RegExpwith one of the functions above. - It places the output inside an HTML
<script>element, as server rendering usually does.
In that case an attacker can run script in the page of any user who receives that output.
Patches
Fixed in 1.6.10. A RegExp whose source contains < is now written with the RegExp constructor and an escaped string source. Named groups and lookbehinds keep working.
Workarounds
If you cannot upgrade:
- Do not serialize a
RegExpbuilt from untrusted pattern syntax. Send its source and flags as strings, and build theRegExpon the client. - Or reject patterns that contain
<before they reach the serializer.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 📦npm | seroval | ≥ 1.5.5&&< 1.6.10 | 1.6.10npm install seroval@1.6.10 |
| 📦npm | seroval | all versions | 1.0.0npm install seroval@1.0.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for seroval, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update seroval to 1.6.10 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-116582 is resolved across your whole dependency graph.
Workarounds
Escape or sanitise the affected output on the server side rather than relying on client-side filtering, and add a Content-Security-Policy that blocks inline script execution so injected markup cannot run even if it reaches the page.
Frequently Asked Questions
Is CVE-2026-116582 in your dependencies?
Find it across npm, including transitive dependencies.