Executive brief
seroval is a JavaScript library used to convert complex data structures into strings for storage or transmission. A vulnerability in how it handles regular expressions allows an attacker to crash the application or cause it to become unresponsive by providing specially crafted, large, or complex patterns. This can lead to a denial-of-service (DoS) condition, impacting the availability of services that rely on this library to process user-supplied data.
Technical details
The seroval library (versions 0.2.0 through 1.4.0) is vulnerable to memory exhaustion and catastrophic backtracking during the deserialization of Regular Expression (RegExp) objects. An attacker can exploit this by providing extremely large patterns that exhaust the JavaScript runtime memory or by supplying patterns designed to trigger ReDoS (CWE-1333). The vulnerability occurs when the default RegExp serialization is overridden or manipulated. This is a network-reachable attack requiring no authentication or user interaction. The issue is resolved in version 1.4.1, which introduces a 'disabledFeatures' bitmask to allow developers to disable RegExp serialization entirely.
Affected products
- lxsmnsyc seroval 0.2.0 - 1.4.0
Timeline
- 2026-01-21: patched: Fixed in version 1.4.1
- 2026-01-21: advisory: GitHub Security Advisory GHSA-hx9m-jf43-8ffr published
- 2026-01-22: disclosed: CVE-2026-23956 published to NVD