CVE-2026-23957

CVE-2026-23957 · seroval is vulnerable to Denial of Service via array serialization

This page contains facts from public vulnerability sources. Check the original advisory before updating.

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

CVSS 7.5 · High · EPSS 0.4% · Fix available

Published: 2026-01-22T01:26:53.869Z
Updated: 2026-01-22T18:56:49.004Z

Stack: node

Affected products and versions

seroval
Versions
- < 1.4.1: Affected
No fix published
seroval npm
Affected ranges
- SEMVER: < 1.4.1
Update to 1.4.1

Original sources

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060
https://nvd.nist.gov/vuln/detail/CVE-2026-23957

Check your server →

CVE-2026-23957 · seroval is vulnerable to Denial of Service via array serialization

Affected products and versions

seroval

seroval npm

Original sources