Kurz gesagt
- CVE-2026-23956 ist eine Schwachstelle (HOCH (CVSS 7.5)) in seroval (lxsmnsyc), seroval.
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.53%, höher als bei 45.1% aller Schwachstellen.
- Abhilfe: auf 1.4.1 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| seroval | < 1.4.1
| 1.4.1
|
| seroval npm | ≥ 0.2.0, < 1.4.1
| 1.4.1
|
Description
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.
NVD description
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free