CVE-2026-23957
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Jan 22, 2026
CISA due date
—
The record
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | seroval | 0 | 1.4.1 |
Related vulnerabilities
- GHSA-66fc-rw6m-c2q6 Seroval affected by Denial of Service via Array serialization Same vulnerability
- GHSA-3j22-8qj3-26mx Seroval affected by Denial of Service via Deeply Nested Objects Also affects seroval
- CVE-2026-24006 Seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23956 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23736 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- CVE-2026-23737 seroval facilitates JS value stringification, including complex structures beyond… Also affects seroval
- GHSA-hx9m-jf43-8ffr seroval affected by Denial of Service via RegExp serialization Also affects seroval
- GHSA-3rxj-6cgf-8cfw seroval Affected by Remote Code Execution via JSON Deserialization Also affects seroval