seroval affected by Denial of Service via RegExp serialization

高 7.5CVE-2026-23956 · GHSA-hx9m-jf43-8ffr · 22/01/2026 公開 · 17/06/2026 更新

要点

CVE-2026-23956 は seroval (lxsmnsyc), seroval に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.53%（全脆弱性の 45.1% より高い）。
対処：1.4.1 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
seroval lxsmnsyc	`< 1.4.1`	`1.4.1`
seroval npm	`≥ 0.2.0, < 1.4.1`	`1.4.1`

概要

Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).

Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.

NVD の説明

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.