What’s Vulnerable › Vulnerabilities

CVE-2026-23956: seroval affected by Denial of Service via RegExp serialization

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-01-22 · updated 2026-06-17
• Weakness: CWE-1333

Description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

Affected products

• lxsmnsyc seroval: before 1.4.1 — fixed in 1.4.1

How to fix

Upgrade to a fixed version: lxsmnsyc seroval 1.4.1. Check the vendor advisory for mitigations.

References

• https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr

Get alerted when CVE-2026-23956 or the next vulnerability affects your stack