CVE-2026-23956
High · 7.5CVSS
7.5
EPSS
0.5%
Published
Jan 22, 2026
CISA due date
—
The record
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | seroval | 0.2.0 | 1.4.1 |
Related vulnerabilities
- GHSA-hx9m-jf43-8ffr seroval affected by Denial of Service via RegExp serialization Same vulnerability
- GHSA-3j22-8qj3-26mx Seroval affected by Denial of Service via Deeply Nested Objects Also affects seroval
- CVE-2026-24006 Seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23957 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23736 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23737 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- GHSA-66fc-rw6m-c2q6 Seroval affected by Denial of Service via Array serialization Also affects seroval
- GHSA-3rxj-6cgf-8cfw seroval Affected by Remote Code Execution via JSON Deserialization Also affects seroval