CVE-2026-23736: seroval Prototype Pollution via JSON Deserialization
Summary
CVE-2026-23736: seroval Affected by Prototype Pollution via JSON Deserialization. Affects seroval versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Seroval is an open-source library available in the npm ecosystem, designed for serializing and deserializing JavaScript objects. It is widely used in applications that require efficient data interchange. However, it has been found to be vulnerable to prototype pollution, which can lead to significant security risks if exploited.
Vulnerability Detail
The vulnerability arises from improper input validation during JSON deserialization. A malicious actor can craft an object with a harmful key that, when processed by seroval, can manipulate the prototype of JavaScript objects. This can lead to unauthorized access or modification of properties, potentially compromising the integrity and security of the application.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
npm install seroval@1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
npm install seroval@1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there is no known workaround for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
The seroval package is vulnerable to prototype pollution due to improper input validation during JSON deserialization. Users are strongly advised to upgrade to version 1.4.1 or later to protect their applications from potential exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for seroval →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to manipulate the prototype of a base object in JavaScript, potentially leading to unauthorized access or modification of properties.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Exploitation of this vulnerability can lead to severe security issues, including unauthorized data access, data corruption, and application instability.
Yes, the CVSS score for this vulnerability is 7.3, indicating a high severity level.
While there is no workaround available, it is crucial to prioritize upgrading to the patched version as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for seroval.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
