Seroval `1.6.8` / `1.6.11`, Highcharts `13.1.0`, Vue I18n `11.4.14`, and GraphQL Tools `1.1.36` patch deserialization, prototype pollution, XSS, and WebSocket auth bleed

CVE

CVE-2026-116580, CVE-2026-116581, CVE-2026-116582, CVE-2026-116583, CVE-2026-116584, CVE-2026-118242, CVE-2026-118243, CVE-2026-118244, CVE-2026-118245, CVE-2026-118246, CVE-2026-118247, CVE-2026-118249, CVE-2026-118250, CVE-2026-118251, CVE-2026-118252, CVE-2026-118253, CVE-2026-118254, CVE-2026-118255, CVE-2026-116796, CVE-2026-116797, CVE-2026-118256, CVE-2026-118257, CVE-2026-118665, CVE-2026-118666

CWE

CWE-502, CWE-94, CWE-1321, CWE-79, CWE-613, CWE-200, CWE-400

Affected Surface

• npm `seroval` versions `<= 1.6.7` (`CVE-2026-116580`, `CVE-2026-116581`, `CVE-2026-116584`, fixed in `1.6.8`) and `>= 1.6.0, < 1.6.11` (`CVE-2026-116582`, `CVE-2026-116583`, fixed in `1.6.11`; `1.7.3` current)
• npm `highcharts` versions `< 11.4.9`, `>= 12.0.0, < 12.6.1`, and `>= 13.0.0, < 13.1.0`; `@highcharts/dashboards < 4.2.3`; and `@highcharts/grid-lite` / `@highcharts/grid-pro < 3.2.0`
• npm `vue-i18n`, `petite-vue-i18n`, `@intlify/core`, `@intlify/core-base`, `@intlify/vue-i18n-core`, and `@intlify/shared` versions `9.14.5`, `10.0.8`, `>= 11.1.10, < 11.4.14`, and `12.0.0-alpha.4` (`CVE-2026-118257`, `CVE-2026-118256`)
• npm `@graphql-tools/executor-legacy-ws` versions `<= 1.1.35` (`CVE-2026-118665`, `CVE-2026-118666`, fixed in `1.1.36`)

TL;DR

On 28 October 2026 (19:55 to 21:17 UTC), the GitHub Advisory Database and NVD published 21 reviewed security advisories across four heavily used JavaScript and TypeScript ecosystems:

1. Seroval (seroval 1.6.8 and 1.6.11, 5 CVEs): Used by SSR and RPC frameworks (including SolidStart and Vinxi) to serialize complex JavaScript values across server/client boundaries. In <= 1.6.7, fromJSON reconstructed AsyncIteratorFactoryInstance nodes by calling source.on(listener) without verifying that source was a genuine Stream instance (CVE-2026-116580, High), and trusted wire-supplied { length: 1e9 } objects on array nodes and out-of-bounds doneAt indices on sequence nodes (CVE-2026-116581, CVE-2026-116584, High) to freeze the Node.js event loop. In >= 1.6.0, < 1.6.11, serialize() read current.constructor.name off typed arrays (CVE-2026-116583) and emitted unescaped RegExp sources (CVE-2026-116582), enabling SSR code injection when an own constructor property was attached to a typed array.
2. Highcharts Core, Dashboards, and Grid (13 CVEs, fixed in highcharts 13.1.0 / 12.6.1 / 11.4.9, @highcharts/dashboards 4.2.2 / 4.2.3, and @highcharts/grid-pro / grid-lite 3.2.0): Two Object.prototype pollution flaws via dotted series.keys (CVE-2026-118250, CVSS 8.4 High) and series column construction (CVE-2026-118249, High) plus two Dashboards/Grid DataTable __proto__ writers (CVE-2026-118243, CVE-2026-118247); an unchecked Highcharts[this.chartConstructor] namespace lookup in Dashboards (CVE-2026-118245, CVSS 8.6 High); and eight DOM/SVG XSS vectors via breadcrumbs.style SVG attributes (CVE-2026-118246), Grid cells.renderer.attributes and custom icons (CVE-2026-116797, CVE-2026-118242), credits.href javascript: URLs (CVE-2026-118251, CVE-2026-118255), xlink:href export survival (CVE-2026-116796), print innerHTML fallback (CVE-2026-118244), and unescaped HTML in Grid/Dashboards labels (CVE-2026-118252, CVE-2026-118253, CVE-2026-118254).
3. Vue I18n and @intlify/* (CVE-2026-118257 / GHSA-83rm-6c8r-g728, High, fixed in 11.4.14): When escapeParameter: true (escapeParameterHtml in the Legacy API) was enabled, sanitizeTranslatedHtml() neutralized on* event handlers and escaped < / > in attribute values, but did not neutralize <iframe srcdoc="...">. Because the browser HTML-entity-decodes srcdoc before parsing it as a nested document, t('msg', { content: '<script>...</script>' }) executed arbitrary JavaScript inside the host origin.
4. GraphQL Tools Legacy WebSocket Executor (@graphql-tools/executor-legacy-ws <= 1.1.35, CVE-2026-118665 High and CVE-2026-118666 Medium, fixed in 1.1.36): buildWSLegacyExecutor() stored per-request extensions.connectionParams in closure-scoped executorConnectionParams and shared a single websocket.onmessage handler that ignored the GraphQL id field, replaying User A’s WebSocket credentials on User B’s reconnect (CVE-2026-118665) and routing one caller’s subscription DATA frames to another caller (CVE-2026-118666).

What to do now: Upgrade seroval to >= 1.6.11 (1.7.3 is current), highcharts to >= 13.1.0 (12.6.1 or 11.4.9), @highcharts/dashboards to >= 4.2.3, @highcharts/grid-pro / @highcharts/grid-lite to >= 3.2.0, vue-i18n / @intlify/* to >= 11.4.14 (11.4.16 is current), and @graphql-tools/executor-legacy-ws to >= 1.1.36 (2.0.7 is current).

Affected packages and projects

Ecosystem	Package(s)	CVE / GHSA	Severity	Affected versions	Fixed version(s)	Vulnerable component
npm	seroval	CVE-2026-116580 (GHSA-7rv5-mrxv-xcr9)	CVSS 7.3 High	<= 1.6.7	1.6.8	packages/seroval/src/core/context/deserializer.ts, stream.ts, sequence.ts
npm	seroval	CVE-2026-116581 (GHSA-97r2-qh9m-474h), CVE-2026-116584 (GHSA-wp97-x4hv-qvhp)	CVSS 7.5 High	<= 1.6.7 (116581); >= 1.4.1, <= 1.6.7 (116584)	1.6.8	packages/seroval/src/core/context/deserializer.ts (validateNodeList, isSequenceIndex)
npm	seroval	CVE-2026-116583 (GHSA-f86p-h4j2-7qgj), CVE-2026-116582 (GHSA-9wx9-5pv9-3349)	Medium	>= 1.6.0, < 1.6.11	1.6.11 (1.7.3 current)	packages/seroval/src/core/base-primitives.ts, context/parser.ts (getTypedArrayName)
npm	highcharts	CVE-2026-118250 (GHSA-rmqc-xvr3-v46c), CVE-2026-118249 (GHSA-gfvx-2c2g-38wq)	CVSS 8.4 High	>= 6.1.0, < 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, <= 13.0.2 (118249 is 13.0.x only)	11.4.9, 12.6.1, 13.1.0	ts/Core/Series/Point.ts (series.keys prototype pollution) and column construction
npm	highcharts	CVE-2026-118246 (GHSA-35rr-xwfh-x789), CVE-2026-118251 (GHSA-5793-x2q3-c3q7), CVE-2026-118244 (GHSA-65hg-cf3f-5m39), CVE-2026-116796 (GHSA-mw4f-gj5x-6xr4)	CVSS 8.4 High	< 11.4.9; >= 12.0.0, < 12.6.1; >= 13.0.0, <= 13.0.2	11.4.9, 12.6.1, 13.1.0	ts/Extensions/Breadcrumbs/Breadcrumbs.ts, credits.href, SVG print/export
npm	@highcharts/dashboards	CVE-2026-118245 (GHSA-grj7-r4jv-pw9j), CVE-2026-118252 (GHSA-rcqf-f6h2-ccg9), CVE-2026-118253 (GHSA-58g7-7f52-h92c), CVE-2026-118243, CVE-2026-118247	CVSS 8.6 High / Medium	>= 1.0.0, < 4.2.3 (118245 fixed in 4.2.2; 118252/118253 fixed in 4.2.3)	4.2.3	ts/Dashboards/Components/HighchartsComponent/HighchartsComponent.ts, edit-mode sidebar/fullscreen labels, DataTable
npm	@highcharts/grid-pro, @highcharts/grid-lite	CVE-2026-116797 (GHSA-5ghw-9mgr-jvx2), CVE-2026-118242 (GHSA-6g3c-p4fg-xv47), CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2), CVE-2026-118255 (GHSA-6hgp-fmhr-mrg4)	CVSS 8.5 / 8.6 High	>= 2.0.0, < 3.2.0	3.2.0	ts/Grid/Core/GridUtils.ts, CheckboxContent.ts, Pagination.ts, credits.href
npm	vue-i18n, petite-vue-i18n, @intlify/*	CVE-2026-118257 (GHSA-83rm-6c8r-g728), CVE-2026-118256 (GHSA-8rc2-428q-7ww3)	CVSS 7.2 High / Low	9.14.5, 10.0.8, >= 11.1.10, < 11.4.14, 12.0.0-alpha.4	11.4.14, 12.0.0-alpha.5 (11.4.16 current)	packages/shared/src/sanitize.ts (sanitizeTranslatedHtml)
npm	@graphql-tools/executor-legacy-ws	CVE-2026-118665 (GHSA-434m-5hcj-pxf3), CVE-2026-118666 (GHSA-mp66-8ww2-pcwm)	CVSS 8.2 High / Medium	<= 1.1.35	1.1.36 (2.0.7 current)	packages/executors/legacy-ws/src/index.ts (buildWSLegacyExecutor)

Technical analysis

1. Seroval (CVE-2026-116580, CVE-2026-116581, CVE-2026-116584, and CVE-2026-116583): forged stream callables, non-array length amplification, and typed-array constructor injection

Seroval serializes JavaScript structures into an intermediate node tree (SerovalNode) for JSON transport (toJSON / fromJSON, toCrossJSON / fromCrossJSON) or direct JavaScript source emission (serialize / crossSerialize).

Three distinct issues affected fromJSON / fromCrossJSON in seroval <= 1.6.7:

• Forged Stream / Sequence identity and arbitrary .on() invocation (CVE-2026-116580 / GHSA-7rv5-mrxv-xcr9): Previously, Stream and Sequence were plain TypeScript interfaces tagged with a __SEROVAL_STREAM__: true or __SEROVAL_SEQUENCE__: true property, and deserializeAsyncIteratorFactoryInstance() called source.on(listener) without verifying that the deserialized source object was an actual internal Stream. By referencing another node in the payload (such as an object returned by an application plugin or an EventEmitter-like object), an attacker could cause fromJSON to invoke source.on(...) with a controlled callback. Commit 3edc78b495 and commit 50926b3ee1 convert Stream and Sequence into unexported classes and enforce instanceof Stream / instanceof Sequence checks (isStream(source), isSequence(source)).
• Unvalidated array-like { length: 1e9 } and sequence doneAt event-loop DoS (CVE-2026-116581 / GHSA-97r2-qh9m-474h and CVE-2026-116584 / GHSA-wp97-x4hv-qvhp): In packages/seroval/src/core/context/deserializer.ts, deserializeArray() read const items = node.a; const len = items.length; without checking Array.isArray(items). Sending a 40-byte JSON node with "a": { "length": 1000000000 } forced the deserializer to allocate and iterate one billion times on the Node.js event loop. Similarly, deserializeSequence() accepted a negative or out-of-bounds doneAt (node.l) index, producing an iterator whose termination condition (i === seq.d) was never reached:

--- a/packages/seroval/src/core/context/deserializer.ts
+++ b/packages/seroval/src/core/context/deserializer.ts
@@ -276,12 +276,27 @@ function deserializeReference(
+function validateNodeList(
+  node: SerovalNode | SerovalObjectRecordNode,
+  list: unknown,
+): void {
+  if (!Array.isArray(list)) {
+    throw new SerovalMalformedNodeError(node as SerovalNode);
+  }
+}
+
 function deserializeArray(
   ctx: DeserializerContext,
   depth: number,
   node: SerovalArrayNode,
 ): unknown[] {
   const items = node.a;
+  validateNodeList(node, items);
   const len = items.length;

Separately, in seroval >= 1.6.0, < 1.6.11, createTypedArrayNode() and getArrayBufferView() read current.constructor.name directly off the typed array instance (CVE-2026-116583 / GHSA-f86p-h4j2-7qgj). If an application copied untrusted keys onto a Uint8Array (setting an own property arr.constructor = { name: "alert(1)//" }), serialize() emitted new alert(1)//(...) directly into the SSR HTML output. Commit 1313ebbad9 (1.6.11) resolves the constructor name from the typed array’s internal Object.prototype.toString.call(current) tag via getTypedArrayName(current).

2. Highcharts (CVE-2026-118250, CVE-2026-118249, CVE-2026-118245, CVE-2026-118246, and CVE-2026-116797): prototype pollution, namespace invocation, and DOM/SVG XSS

Highcharts published 13 advisories across its core charting library, @highcharts/dashboards, and @highcharts/grid-pro / @highcharts/grid-lite:

1. Object.prototype pollution via series.keys (CVE-2026-118250 / GHSA-rmqc-xvr3-v46c) and column construction (CVE-2026-118249 / GHSA-gfvx-2c2g-38wq): When mapping array-based point data onto point properties using series.keys, Point.ts split each key on . and walked the target object without blocking __proto__ or constructor. Passing keys: ['__proto__.polluted', 'y'] with data: [['yes', 1]] wrote polluted: 'yes' onto Object.prototype for the entire page (commit fd4ee81407):

   --- a/ts/Core/Series/Point.ts
   +++ b/ts/Core/Series/Point.ts
   @@ -1182,6 +1182,13 @@ class Point {
        ): T {
            const nestedKeys = key.split('.');
   +        // Reject nested keys that would allow prototype pollution
   +        if (nestedKeys.some((nestedKey): boolean => (
   +            nestedKey === '__proto__' || nestedKey === 'constructor'
   +        ))) {
   +            return object;
   +        }

   In Highcharts 13.0.0 through 13.0.2, building series data columns from point objects also used raw point keys (__proto__, constructor) as column IDs (CVE-2026-118249, commit d3357705c8).
2. Unchecked chartConstructor lookup in @highcharts/dashboards (CVE-2026-118245 / GHSA-grj7-r4jv-pw9j, CVSS 8.6 High): In HighchartsComponent.ts, createChart() looked up const Factory = charter[this.chartConstructor] and invoked Factory(container, chartOptions) without checking this.chartConstructor against an allowlist. A dashboard JSON config could name any function attached to the Highcharts namespace. Commit 98d3652cdc (dashboards-v4.2.2) restricts chartConstructor to ['chart', 'stockChart', 'mapChart', 'ganttChart'].
3. SVG and DOM XSS via breadcrumbs.style (CVE-2026-118246), Grid cells.renderer.attributes (CVE-2026-116797), custom icons (CVE-2026-118242), and pagination/sidebar HTML (CVE-2026-118252..118254):
   • In Breadcrumbs.ts, breadcrumbs.style was applied to the SVG breadcrumb button via .attr() instead of .css(), turning keys like onmouseover or onload into live SVG event-handler attributes (commit b0fafdaaee).
   • In @highcharts/grid-pro, input cell renderers (CheckboxContent, TextInputContent, SelectContent) ran Object.entries(options.attributes).forEach(([k, v]) => input.setAttribute(k, v)) without filtering on* event handlers (commit 52abd4f8f8).
   • In @highcharts/grid-lite and grid-pro, Pagination.ts assigned this.pageInfoElement.innerHTML = pageInfoText instead of textContent (commit 1e8ded84d5).

3. Vue I18n (CVE-2026-118257): escapeParameter XSS bypass via <iframe srcdoc="...">

When Vue applications render HTML inside translation messages (v-html="$t('welcome', { name: userInput })"), Vue I18n’s escapeParameter: true option passes the interpolated string through sanitizeTranslatedHtml() in packages/shared/src/sanitize.ts.

Before 11.4.14, sanitizeTranslatedHtml() escaped < and > inside quoted attribute values and neutralized on* event handlers (onclick -> onclick), javascript: URLs, and <script> / <style> tags, but left the srcdoc attribute on <iframe> untouched. Because browsers HTML-entity-decode the srcdoc attribute value before parsing it as a nested HTML document on the parent’s origin, entity-escaping {content} inside <iframe srcdoc="{content}"></iframe> was completely undone by the browser’s srcdoc parser! Even <iframe srcdoc="&lt;script&gt;alert(document.domain)&lt;/script&gt;"></iframe> executed in the host origin.

Commit 43391d20e7 (PR #2679, released in v11.4.14 and v12.0.0-alpha.5) neutralizes srcdoc= into srcdoc= alongside on*= attributes:

--- a/packages/shared/src/sanitize.ts
+++ b/packages/shared/src/sanitize.ts
@@ -29,6 +29,10 @@ const colonCharacterReferencePattern = /:?/gi
 const controlOrWhitespacePattern = /[\u0000-\u0020\u007f-\u009f]/g
 const eventHandlerPattern = /(?:^|[\s"'<>/])on\w+\s*=\s*["']?[^"'>]+["']?/i
 const eventHandlerAttributePattern = /(^|[\s"'<>/])on(\w+\s*=)/gi
+// `srcdoc` holds a whole HTML document: its value is entity-decoded and then parsed again,
+// so neither escaping the value nor neutralizing `on*` inside it makes it inert
+const srcdocPattern = /(?:^|[\s"'<>/])srcdoc\s*=/i
+const srcdocAttributePattern = /(^|[\s"'<>/])s(rcdoc\s*=)/gi
...
+  if (srcdocPattern.test(html)) {
+    html = html.replace(srcdocAttributePattern, '$1&#115;$2')
+  }

4. GraphQL Tools (CVE-2026-118665 and CVE-2026-118666): WebSocket connectionParams replay and cross-caller subscription bleed in @graphql-tools/executor-legacy-ws

In @graphql-tools/executor-legacy-ws (<= 1.1.35), buildWSLegacyExecutor() created a single closure-scoped let executorConnectionParams = {} and let websocket: WebSocket | null = null across all callers of the executor:

1. Cross-user connectionParams authentication persistence (CVE-2026-118665 / GHSA-434m-5hcj-pxf3): When Request A passed per-request credentials via request.extensions.connectionParams (for example { authToken: "user-a-jwt" }), the executor ran executorConnectionParams = Object.assign(executorConnectionParams, request.extensions?.connectionParams). When the WebSocket later reconnected for Request B (which passed no connectionParams or only partial fields), the onopen handler sent connection_init with payload: executorConnectionParams, authenticating User B’s WebSocket session as User A.
2. Cross-tenant subscription result delivery (CVE-2026-118666 / GHSA-mp66-8ww2-pcwm): Every call to subscribe() overwrote websocket.onmessage = event => { ... } on the shared socket and dispatched GQL_DATA frames without checking data.id === subscriptionId. Concurrent subscribers on the same executor received each other’s GraphQL subscription payloads.

Commit c2f226e6f6 (PR #8480, released in @graphql-tools/executor-legacy-ws@1.1.36) opens a dedicated WebSocket per execution, builds connection_init from a fresh merge of options?.connectionParams and the current request’s extensions.connectionParams, and verifies data.id !== subscriptionId before delivering DATA, ERROR, or COMPLETE frames.

Detection and remediation

# 1. Check installed versions in node_modules
npm ls seroval highcharts @highcharts/dashboards @highcharts/grid-pro @highcharts/grid-lite \
  vue-i18n @intlify/shared @intlify/core-base @graphql-tools/executor-legacy-ws 2>/dev/null || true

# 2. Search lockfiles for vulnerable packages
rg -n '"(seroval|highcharts|@highcharts/dashboards|@highcharts/grid-pro|@highcharts/grid-lite|vue-i18n|@intlify/shared|@graphql-tools/executor-legacy-ws)"' \
  package.json package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

# 3. Search codebases for vulnerable APIs
rg -n '\b(fromJSON|fromCrossJSON|buildWSLegacyExecutor|escapeParameter|escapeParameterHtml|chartConstructor)\b' \
  --glob '*.{js,jsx,ts,tsx,vue,mjs}' . 2>/dev/null

1. Upgrade seroval: Upgrade to seroval >= 1.6.11 (1.7.3 is latest) so both the fromJSON / fromCrossJSON validation fixes (1.6.8) and the typed-array / RegExp serializer fixes (1.6.11) are present.
2. Upgrade Highcharts packages: Upgrade highcharts to >= 13.1.0 (or >= 12.6.1 / >= 11.4.9), @highcharts/dashboards to >= 4.2.3, and @highcharts/grid-pro / @highcharts/grid-lite to >= 3.2.0.
3. Upgrade Vue I18n (@intlify/*): Upgrade vue-i18n, petite-vue-i18n, and @intlify/shared to >= 11.4.14 (11.4.16 is latest). Note that vue-i18n 9.x (9.14.5) and 10.x (10.0.8) do not receive upstream backports; if you cannot upgrade to 11.4.14+ immediately, strip srcdoc attributes with DOMPurify before passing t() output into v-html.
4. Upgrade @graphql-tools/executor-legacy-ws: Upgrade to >= 1.1.36 (2.0.7 is latest).

Timeline

• 2026-09-08 to 2026-09-17: Highcharts commits prototype-pollution, chartConstructor, breadcrumbs.style, and Grid attribute/pagination fixes (fd4ee81407, d3357705c8, 98d3652cdc, b0fafdaaee, 52abd4f8f8, 1e8ded84d5).
• 2026-09-28 to 2026-10-18: Seroval releases 1.6.8 (3edc78b495, cdcee3e3bc, e176f9267e, 50926b3ee1) and 1.6.11 (1313ebbad9).
• 2026-09-30: GraphQL Tools merges PR #8480 (c2f226e6f6) and publishes @graphql-tools/executor-legacy-ws@1.1.36.
• 2026-10-10: Vue I18n merges PR #2679 (43391d20e7) and releases v11.4.14 and v12.0.0-alpha.5.
• 2026-10-28 (19:55 to 21:17 UTC): The GitHub Advisory Database and NVD publish the 21 reviewed advisories across Highcharts, Vue I18n, GraphQL Tools, and Seroval.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo

References

• Seroval advisories GHSA-7rv5-mrxv-xcr9 (CVE-2026-116580), GHSA-97r2-qh9m-474h (CVE-2026-116581), GHSA-wp97-x4hv-qvhp (CVE-2026-116584), and GHSA-f86p-h4j2-7qgj (CVE-2026-116583)
• lxsmnsyc/seroval commits 3edc78b495, cdcee3e3bc, e176f9267e, and 1313ebbad9
• Highcharts advisories GHSA-rmqc-xvr3-v46c (CVE-2026-118250), GHSA-gfvx-2c2g-38wq (CVE-2026-118249), GHSA-grj7-r4jv-pw9j (CVE-2026-118245), and GHSA-35rr-xwfh-x789 (CVE-2026-118246)
• highcharts/highcharts commits fd4ee81407, d3357705c8, 98d3652cdc, b0fafdaaee, and 52abd4f8f8
• Vue I18n advisory GHSA-83rm-6c8r-g728 (CVE-2026-118257) and commit 43391d20e7
• GraphQL Tools advisories GHSA-434m-5hcj-pxf3 (CVE-2026-118665), GHSA-mp66-8ww2-pcwm (CVE-2026-118666), and commit c2f226e6f6