GitHub Advisoryadvisory · npm

GHSA-hj76-42vx-jwp4 seroval Affected by Prototype Pollution via JSON Deserialization

HIGH Published 2026-01-21 Modified 2026-01-22 Official page ↗
Aliases
CVE-2026-23736
Ecosystem
npm
Packages
seroval
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-1321
Reviewed
2026-01-21

Affected packages

• npm seroval: < 1.4.1 → fixed in 1.4.1

Description

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This affects only JSON deserialization functionality. As there is no known workaround, please upgrade to the latest version.

Related

Alias · CVE (1)

  • CVE-2026-23736 seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References