CVE-2026-23956

High

Published: 22/01/2026(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization.

Risk Assessment

Overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS attacks, posing a denial of service risk in applications using seroval.

Recommendation

It is recommended to upgrade to version 1.4.1 to mitigate this vulnerability and to monitor the use of RegExp in applications.

Other vulnerabilities in seroval

CVE-2026-59940Critical
Seroval prior to 1.5.3 allows attacker-controlled JSON deserialization that can lead to unintended side effects, and when combined with frameworks registering callable wrappers, potentially unintended server-side invocation or remote code execution.

Original NVD description (English source)

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.