CVE-2026-104846

About vulnerability

A fulfilled Promise node deserialized by fromJSON() can trigger unintended invocation of a plugin-produced callable through native ECMAScript thenable assimilation. This bypasses the type-confusion fix in [email protected] (GHSA-mv8w-475r-vwqw / CVE-2026-59940) and affects every plugin-capable release from 0.12.0 through the current 1.6.0.

Affected product:

TanStack/devtools , TanStack/router , TanStack/table , ag-grid , ai-sdk-solid , ariakit , ariakit-solid , ariakit-solid-components , ariakit-solid-utils , ariakit-store , astro , astrojs-markdown-remark , astrojs-mdx , astrojs-preact , astrojs-solid-js , astrojs-vue , babel-preset-solid , corvu , dnd-kit , dnd-kit-solid , dnd-kit-vue , dom-expressions , effect , effect-ai-anthropic , effect-ai-cloudflare , effect-ai-openai , effect-ai-openai-compat , effect-ai-openrouter , effect-ai-typesafe , effect-atom-react , effect-atom-solid , effect-atom-vue , effect-docgen , effect-doctest , effect-openapi-generator , effect-opentelemetry , effect-platform-browser , effect-platform-bun , effect-platform-deno , effect-platform-node , effect-sql-clickhouse , effect-sql-d1 , effect-sql-libsql , effect-sql-mssql , effect-sql-mysql2 , effect-sql-pg , effect-sql-pglite , effect-sql-sqlite-bun , effect-sql-sqlite-do , effect-sql-sqlite-node , effect-sql-sqlite-react-native , effect-sql-sqlite-wasm , effect-vitest , embla-carousel , ext-apps , form , hotkeys , hyper-dom-expressions , json-render , json-render-codegen , json-render-core , json-render-devtools , json-render-devtools-react , json-render-devtools-solid , json-render-devtools-svelte , json-render-devtools-vue , json-render-directives , json-render-image , json-render-ink , json-render-mcp , json-render-next , json-render-react , json-render-react-email , json-render-react-native , json-render-react-pdf , json-render-react-three-fiber , json-render-redux , json-render-remotion , json-render-shadcn , json-render-shadcn-svelte , json-render-solid , json-render-svelte , json-render-tanstack-start , json-render-vue , json-render-xstate , json-render-yaml , json-render-zustand , kobalte , lingui-babel-plugin-lingui-macro , lingui-detect-locale , lingui-extractor-vue , lingui-format-csv , lingui-format-json , lingui-loader , lingui-metro-transformer , lingui-solid , lit-dom-expressions , livestore , livestore-webmesh , lottiefiles-dotlottie-solid , lucide , lucide-astro , lucide-icons , lucide-preact , lucide-react-native , lucide-solid , lucide-static , lucide-svelte , lucide-vue , modelcontextprotocol-ext-apps , neodrag , octanejs-aria , octanejs-devtools , octanejs-seo , octanejs-shadcn , octanejs-tanstack-ai , octanejs-tanstack-devtools , octanejs-tanstack-form , octanejs-tanstack-hotkeys , octanejs-tanstack-pacer , octanejs-tanstack-store , octanejs-tiptap , opentui , opentui-core , opentui-qrcode , opentui-solid , opentui-ssh , opentui-three , orpc , orpc-ai-sdk , orpc-arktype , orpc-experimental-durable-iterator , orpc-experimental-pino , orpc-experimental-publisher , orpc-experimental-publisher-durable-object , orpc-experimental-ratelimit , orpc-experimental-react-swr , orpc-hey-api , orpc-nest , orpc-otel , orpc-react , orpc-react-query , orpc-server , orpc-solid-query , orpc-tanstack-query , orpc-trpc , orpc-valibot , orpc-vue-colada , orpc-vue-query , pacer , query , ripple , rsbuild , rsbuild-plugin-react , rspress , sentry-astro , sentry-deno , sentry-effect , sentry-elysia , sentry-ember , sentry-eslint-config-sdk , sentry-eslint-plugin-sdk , sentry-gatsby , sentry-google-cloud-serverless , sentry-hono , sentry-javascript , sentry-nitro , sentry-node-native , sentry-replay , sentry-server-runtime-injection , sentry-server-utils , sentry-solid , sentry-solidstart , sentry-tanstackstart , sentry-tanstackstart-react , sentry-wasm , seroval , seroval-plugins , solid , solid-devtools , solid-devtools-debugger , solid-devtools-frontend , solid-devtools-logger , solid-headless , solid-list , solid-markdown , solid-meta , solid-presence , solid-prevent-scroll , solid-primitives , solid-primitives-keyboard , solid-primitives-keyed , solid-primitives-props , solid-primitives-resource , solid-primitives-storage , solid-refresh , solid-sonner , solid-transition-group , solid-use , solid-vite-plugin , solidjs-start , solidjs-web , tabler-icons , tabler-icons-angular , tabler-icons-astro , tabler-icons-png , tabler-icons-preact , tabler-icons-solidjs , tabler-icons-sprite , tabler-icons-vue , tabler-icons-webfont , tanstack-ai , tanstack-ai-devtools-core , tanstack-ai-solid , tanstack-ai-solid-ui , tanstack-ai-svelte , tanstack-alpine-table , tanstack-angular-devtools , tanstack-angular-hotkeys , tanstack-angular-hotkeys-devtools , tanstack-angular-pacer-devtools , tanstack-angular-query-experimental , tanstack-angular-table , tanstack-angular-table-devtools , tanstack-devtools , tanstack-devtools-a11y , tanstack-devtools-utils , tanstack-ember-table , tanstack-eslint-plugin-query , tanstack-hotkeys-devtools , tanstack-lit-table , tanstack-octane-hotkeys , tanstack-octane-table , tanstack-pacer , tanstack-pacer-devtools , tanstack-preact-ai-devtools , tanstack-preact-hotkeys , tanstack-preact-hotkeys-devtools , tanstack-preact-pacer , tanstack-preact-pacer-devtools , tanstack-preact-query-devtools , tanstack-preact-query-persist-client , tanstack-preact-table , tanstack-preact-table-devtools , tanstack-query-async-storage-persister , tanstack-query-broadcast-client-experimental , tanstack-query-devtools , tanstack-query-persist-client-core , tanstack-query-sync-storage-persister , tanstack-react-form-devtools , tanstack-react-hotkeys , tanstack-react-hotkeys-devtools , tanstack-react-pacer-devtools , tanstack-react-query-devtools , tanstack-react-query-next-experimental , tanstack-react-query-persist-client , tanstack-react-table-devtools , tanstack-router , tanstack-solid-db , tanstack-solid-devtools , tanstack-solid-hotkeys , tanstack-solid-hotkeys-devtools , tanstack-solid-pacer , tanstack-solid-query , tanstack-solid-query-devtools , tanstack-solid-query-persist-client , tanstack-solid-router , tanstack-solid-start , tanstack-solid-start-server , tanstack-solid-store , tanstack-solid-table-devtools , tanstack-solid-virtual , tanstack-start-static-server-functions , tanstack-svelte-devtools , tanstack-svelte-hotkeys , tanstack-svelte-pacer-devtools , tanstack-svelte-query , tanstack-svelte-query-devtools , tanstack-svelte-query-persist-client , tanstack-svelte-table , tanstack-table , tanstack-vue-devtools , tanstack-vue-hotkeys-devtools , tanstack-vue-pacer-devtools , tanstack-vue-query , tanstack-vue-start-client , tanstack-vue-start-server , tanstack-vue-table , tanstack-vue-table-devtools , terracotta , tsrx , tsrx-bun-plugin-solid , tsrx-hono , tsrx-preact , tsrx-rspack-plugin-solid , tsrx-runtime , tsrx-solid , tsrx-vite-plugin-solid , tsrx-vue , unhead , unhead-addons , unhead-angular , unhead-dom , unhead-react , unhead-schema , unhead-schema-org , unhead-shared , unhead-solid-js , unhead-ssr , unhead-svelte , unhead-vue , virtual , vite-plugin-solid , wagmi-solid , xstate-solid , zag-js-accordion , zag-js-anatomy-icons , zag-js-checkbox , zag-js-docs , zag-js-focus-scope , zag-js-number-utils , zag-js-pin-input , zag-js-react , zag-js-slider , zag-js-solid , zag-js-tooltip , zag-js-vue

Affected packages:

seroval @ 1.5.6 (+3191 more)