PT-2026-3889 · Seroval · Seroval

Lxsmnsyc + 1 · Published 2026-01-21 · Updated 2026-05-20 · CVE-2026-23956

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions seroval versions 1.4.0 and below

Description seroval is a JavaScript library that facilitates value stringification, including complex structures. In versions 1.4.0 and below, overriding RegExp serialization with excessively large patterns can exhaust JavaScript runtime memory during deserialization. Overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). Catastrophic backtracking is a condition where a regular expression engine takes an extremely long time to complete its search due to the structure of the pattern.

Recommendations Configure disabledFeatures to disable RegExp serialization entirely.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2026-23956

GHSA-HX9M-JF43-8FFR

Affected Products

Seroval

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23956.json · Exploit
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr · Vendor Advisory
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-23956 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23956 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hx9m-jf43-8ffr · Vendor Advisory
• https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90 · Note
• https://github.com/lxsmnsyc/seroval · Note
• https://twitter.com/lsof/status/2014398967795040762 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2014263977740488801 · Twitter Post
• https://t.me/CVEtracker/42727 · Telegram Post
• https://t.me/cveNotify/153578 · Telegram Post
• https://t.me/cveNotify/164144 · Telegram Post
• https://twitter.com/CVEnew/status/2014153667927241031 · Twitter Post
• https://twitter.com/cracbot/status/2016103970402664749 · Twitter Post