CVE-2026-23956
seroval affected by Denial of Service via RegExp serialization
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
8th
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
| CWE | CWE-1333 |
| Vendor | lxsmnsyc |
| Product | seroval |
| Published | Jan 22, 2026 |
| Last Updated | May 20, 2026 |
Stay Ahead of the Next One
Get instant alerts for lxsmnsyc seroval
Be the first to know when new high vulnerabilities affecting lxsmnsyc seroval are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
lxsmnsyc / seroval
>= 0.2.0, < 1.4.1