CVE-2026-23956: seroval affected by Denial of Service via RegExp serialization
Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).
Mitigation: Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.
Other sources
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
— MITRE
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23956?
CVE-2026-23956 is considered a high severity vulnerability due to its potential to exhaust JavaScript runtime memory, leading to Denial of Service.
What causes the vulnerability identified as CVE-2026-23956?
CVE-2026-23956 is caused by the ability to override RegExp serialization with extremely large patterns or those that trigger catastrophic backtracking.
How do I fix CVE-2026-23956?
To fix CVE-2026-23956, upgrade to version 1.4.1 or later of the seroval package.
Which versions of seroval are affected by CVE-2026-23956?
Versions of seroval from 1.4.0 and below are affected by CVE-2026-23956.
What is the impact of CVE-2026-23956 on applications?
The impact of CVE-2026-23956 on applications can result in Denial of Service due to memory exhaustion during RegExp deserialization.