CVE-2026-116580: Typescript Untrusted Deserialize Unchecked Type Assertioncve-2026-116580-typescript-untrusted-deserialize-unchecked-type-assertion
Deserialized value $VAL is laundered through a TypeScript type assertion ($TYPE) instead of being proven by a runtime identity check. Untrusted serialized input can place an arbitrary object (or a plugin-produced value) behind the deserialized value, so downstream consumers invoke attacker-chosen methods on it (e.g. `on`, `next`, iterator protocol). Validate
