En bref
- CVE-2026-23956 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant seroval (lxsmnsyc), seroval.
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.53%, plus élevée que 45.1% des vulnérabilités.
- Correctif : mettre à jour vers 1.4.1 ou plus récent.
| Package | Affected versions | Patched versions |
|---|
| seroval | < 1.4.1
| 1.4.1
|
| seroval npm | ≥ 0.2.0, < 1.4.1
| 1.4.1
|
Description
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.
NVD description
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free