CVE-2026-23736
High · 7.3CVSS
7.3
EPSS
0.3%
Published
Jan 21, 2026
CISA due date
—
The record
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | seroval | 0 | 1.4.1 |
Related vulnerabilities
- GHSA-hj76-42vx-jwp4 seroval Affected by Prototype Pollution via JSON Deserialization Same vulnerability
- GHSA-3j22-8qj3-26mx Seroval affected by Denial of Service via Deeply Nested Objects Also affects seroval
- CVE-2026-24006 Seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23956 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23957 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23737 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- GHSA-66fc-rw6m-c2q6 Seroval affected by Denial of Service via Array serialization Also affects seroval
- GHSA-hx9m-jf43-8ffr seroval affected by Denial of Service via RegExp serialization Also affects seroval