PT-2026-3890 · Seroval · Seroval

Tweidinger · Publicado 2026-01-21 · Atualizado 2026-02-27 · CVE-2026-23957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions seroval versions 1.4.0 and below

Description seroval facilitates JavaScript value stringification, including complex structures beyond the capabilities of JSON.stringify. In affected versions, replacing encoded array lengths with excessively large values causes a significant increase in processing time during deserialization. This can lead to performance issues or potential denial-of-service conditions.

Recommendations Update to version 1.4.1 or later. seroval no longer encodes array lengths; it computes length using Array.prototype.length during deserialization.

Exploit

Correção

DoS

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-770

Identificadores relacionados

CVE-2026-23957

GHSA-66FC-RW6M-C2Q6

Produtos afetados

Seroval

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23957.json · Exploit
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Correção
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 · Aviso do Fabricante
• https://github.com/lxsmnsyc/seroval · Nota
• https://twitter.com/lsof/status/2014398990142329046 · Publicação no Twitter
• https://t.me/CVEtracker/42728 · Publicação no Telegram
• https://osv.dev/vulnerability/GHSA-66fc-rw6m-c2q6 · Aviso do Fabricante
• https://t.me/cveNotify/153490 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23957 · Nota de Segurança
• https://twitter.com/cracbot/status/2016103972160078153 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23957 · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2014153667063193883 · Publicação no Twitter