CVE-2026-23956

Published: Jan 22, 2026Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

Affected (1)

Products: Lxsmnsyc: Seroval

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Lxsmnsyc Seroval	Before 1.4.1

Related CWEs

Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References (3)

https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90

Source: security-advisories@github.com

https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060

Source: security-advisories@github.com

Patch

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr

Source: security-advisories@github.com

MitigationVendor Advisory

Timeline

No history available yet.