CVEvulnerability

CVE-2026-23956

7.5 HIGH Published 2026-01-22 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2026-01-22
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-1333

Description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

Affected configurations

• lxsmnsyc seroval (< 1.4.1)

Related

Weakness · CWE (1)

  • CWE-1333 Inefficient Regular Expression Complexity weakness

References