PT-2026-3890 · Seroval · Seroval

Tweidinger · Published 2026-01-21 · Updated 2026-02-27 · CVE-2026-23957

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions seroval versions 1.4.0 and below

Description seroval facilitates JavaScript value stringification, including complex structures beyond the capabilities of JSON.stringify. In affected versions, replacing encoded array lengths with excessively large values causes a significant increase in processing time during deserialization. This can lead to performance issues or potential denial-of-service conditions.

Recommendations Update to version 1.4.1 or later. seroval no longer encodes array lengths; it computes length using Array.prototype.length during deserialization.

Exploit

Fix

DoS

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2026-23957

GHSA-66FC-RW6M-C2Q6

Affected Products

Seroval

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23957.json · Exploit
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 · Patch
• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-66fc-rw6m-c2q6 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23957 · Security Note
• https://osv.dev/vulnerability/CVE-2026-23957 · Vendor Advisory
• https://github.com/lxsmnsyc/seroval · Note
• https://twitter.com/lsof/status/2014398990142329046 · Twitter Post
• https://t.me/CVEtracker/42728 · Telegram Post
• https://t.me/cveNotify/153490 · Telegram Post
• https://twitter.com/cracbot/status/2016103972160078153 · Twitter Post
• https://twitter.com/CVEnew/status/2014153667063193883 · Twitter Post