CVE-2026-23956

HIGH7.5

seroval affected by Denial of Service via RegExp serialization

Published Jan 22, 2026

Modified 1 months ago

Details

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

References

WEB

https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060

WEB

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-23956

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector