ETK-2026-2894Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2894",
  "cve_id": null,
  "display_id": "ETK-2026-2894",
  "ghsa_id": "GHSA-3pfx-gxff-vg76",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Unhandled rejection denial of service in seroval deserializers",
  "summary": "seroval versions before 1.7.2 can leave rejected promises unobserved when applications deserialize untrusted input through fromJSON or fromCrossJSON. On Node.js 15 or later configured to terminate on unhandled rejections, an unauthenticated request may cause the process to exit, potentially before application authentication or validation occurs.",
  "mitigation": "Upgrade the npm seroval package to version 1.7.2 or later. Until upgrading, register a process-level unhandled-rejection handler to avoid process termination and limit untrusted input reaching the affected deserializers.",
  "vendor": "npm",
  "product": "seroval",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 1.7.1"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "1.7.2"
      ],
      "package_name": "seroval",
      "purl": "pkg:npm/seroval"
    }
  ],
  "cwes": [
    248
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": true,
  "check_confidence_basis": "assessed",
  "exploit": false,
  "pipeline_minutes": 18.349637933333334,
  "t0_at": null,
  "signals": {
    "check": {
      "at": "2026-10-28T18:43:43.846674+00:00",
      "days": -1.0558511146412037,
      "is_lower_bound": true,
      "measured_at": "2026-10-29T20:04:09.435306+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T11:51:30+00:00",
      "days": -1.3421224881828704,
      "is_lower_bound": true,
      "measured_at": "2026-10-29T20:04:09.435306+00:00",
      "url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-3pfx-gxff-vg76"
    }
  }
}