p PatchFirst

CVE-2026-23956

CVE-2026-23956 · seroval affected by Denial of Service via RegExp serialization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

CVSS 7.5 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • seroval

    Versions
    • >= 0.2.0, < 1.4.1: Affected

    No fix published

  • seroval npm

    Affected ranges
    • SEMVER: ≥ 0.2.0, < 1.4.1

    Update to 1.4.1

Original sources

Check your server →