GitHub Advisoryadvisory · npm
GHSA-hx9m-jf43-8ffr seroval affected by Denial of Service via RegExp serialization
HIGH
Official page ↗
- Aliases
- CVE-2026-23956
- Ecosystem
- npm
- Packages
- seroval
- Severity
- High
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-1333
- Reviewed
- 2026-01-21
Affected packages
• npm seroval: >= 0.2.0, < 1.4.1 → fixed in 1.4.1
Description
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation:
`Seroval` introduces `disabledFeatures` (a bitmask) in serialization/deserialization methods, with `Feature.RegExp` as a dedicated flag. Users are recommended to configure `disabledFeatures` to disable RegExp serialization entirely.
Related
Alias · CVE (1)
- CVE-2026-23956 seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. vulnerability
Weakness · CWE (1)
- CWE-1333 Inefficient Regular Expression Complexity weakness
References
- https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr web
- https://nvd.nist.gov/vuln/detail/CVE-2026-23956 advisory
- https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 web
- https://github.com/lxsmnsyc/seroval package
- https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90 web