| Package | Affected versions | Patched versions |
|---|---|---|
| seroval | < 1.4.1 | 1.4.1 |
| seroval | ≥ 0.2.0, < 1.4.1 | 1.4.1 |
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free