High severity · published Jan 22, 2026
CVE-2026-23956
seroval affected by Denial of Service via RegExp serialization
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SE
seroval · lxsmnsyc
>= 0.2.0, < 1.4.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23956
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23956
github.com
https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90
Patch
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060
Mitigation
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr
More from seroval
9.8
CVE-2026-104846
Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
9.8
CVE-2026-59940
Seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization
9.8
CVE-2026-23736
seroval Affected by Prototype Pollution via JSON Deserialization
7.5
CVE-2026-116584
Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
CVE-2026-116581
Seroval: fromJSON deserializer trusts sequence doneAt (unauthenticated event-loop DoS)