CVE-2026-23956: seroval Denial of Service via RegExp Serialization
Summary
CVE-2026-23956: seroval affected by Denial of Service via RegExp serialization. Affects seroval versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Seroval is a JavaScript library used for serialization and deserialization of data structures. It allows developers to efficiently convert complex objects into a format that can be easily stored or transmitted. However, its handling of RegExp serialization has introduced a significant vulnerability that can lead to Denial of Service (DoS) attacks, particularly when large patterns are involved.
Vulnerability Detail
The vulnerability arises from the ability to override RegExp serialization with extremely large patterns, which can exhaust JavaScript runtime memory during deserialization. Furthermore, patterns that trigger catastrophic backtracking can lead to Regular Expression Denial of Service (ReDoS). This means that an attacker can craft specific inputs that cause the application to hang or crash, impacting availability and performance.
How To Fix
Latest published version: 1.7.0 as of 22 Oct 2026
npm install seroval@1.7.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.1
This is the first release that contains the fix.
npm install seroval@1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are recommended to configure the serialization and deserialization methods to disable RegExp serialization entirely. This can be achieved by setting the disabledFeatures option as follows:
const seroval = require('seroval');
const options = { disabledFeatures: Feature.RegExp };
const serializedData = seroval.serialize(data, options);
Conclusion
In summary, CVE-2026-23956 affects the seroval package by allowing Denial of Service attacks through RegExp serialization. Users are advised to update to version 1.4.1 or later to mitigate this risk, and to consider the provided workaround if immediate updates are not feasible.
See every vulnerability recorded for seroval →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The potential impacts include application crashes, unavailability of services, and degraded performance due to excessive memory consumption.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
If you cannot update the package immediately, implement the recommended workaround to disable RegExp serialization until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for seroval.
