CVE-2026-23956: lxsmnsyc seroval Denial of Service via RegExp serialization

CVE-2026-23956 · Severity: high · CVSS 7.5 · Published 2026-01-22

seroval is a JavaScript library used to convert complex data structures into strings for storage or transmission. A vulnerability in how it handles regular expressions allows an attacker to crash the application or cause it to become unresponsive by providing specially crafted, large, or complex patterns. This can lead to a denial-of-service (DoS) condition, impacting the availability of services that rely on this library to process user-supplied data.

Technologies: seroval (npm). Vendors: npm.

Quick answers

Is CVE-2026-23956 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23956 being exploited in the wild.
How severe is CVE-2026-23956?
High severity, with a CVSS score of 7.5, published 22 January 2026.
Which products and versions are affected?
seroval (npm) >= 0.2.0, <= 1.4.0, SEMVER:introduced=0.2.0,fixed=1.4.1.
Is there a fix for CVE-2026-23956?
Yes. seroval (npm): upgrade to 1.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23956 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23956?
Check whether you run seroval (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • seroval (npm): upgrade to 1.4.1 or later
    npm install seroval@1.4.1

Technical details

The seroval library (versions 0.2.0 through 1.4.0) is vulnerable to memory exhaustion and catastrophic backtracking during the deserialization of Regular Expression (RegExp) objects. An attacker can exploit this by providing extremely large patterns that exhaust the JavaScript runtime memory or by supplying patterns designed to trigger ReDoS (CWE-1333). The vulnerability occurs when the default RegExp serialization is overridden or manipulated. This is a network-reachable attack requiring no authentication or user interaction. The issue is resolved in version 1.4.1, which introduces a 'disabledFeatures' bitmask to allow developers to disable RegExp serialization entirely.

Affected products

  • lxsmnsyc seroval 0.2.0 - 1.4.0

Identifiers

  • CVE-2026-23956
  • GHSA-hx9m-jf43-8ffr

Timeline

  • 2026-01-21: patched: Fixed in version 1.4.1
  • 2026-01-21: advisory: GitHub Security Advisory GHSA-hx9m-jf43-8ffr published
  • 2026-01-22: disclosed: CVE-2026-23956 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.