JS Runtime Memory Exhaustion Vulnerability in Seroval by lxsmnsyc
CVE-2026-23956

7.5HIGH

Key Information:

Vendor

Lxsmnsyc

Status
Seroval
Vendor
CVE Published:
22 January 2026

What is CVE-2026-23956?

The seroval library, designed to facilitate JavaScript value stringification, has a vulnerability in versions 1.4.0 and earlier that can lead to memory exhaustion during deserialization. This occurs primarily when complex RegExp patterns are used for serialization, causing JavaScript runtime memory to be exhausted. Additionally, certain patterns that enable catastrophic backtracking can lead to a Regular Expression Denial of Service (ReDoS) attack, impacting the application’s performance and availability. Users are advised to upgrade to version 1.4.1 or later for improved security and stability.

Affected Version(s)

seroval >= 0.2.0, < 1.4.1

References

https://github.com/lxsmnsyc/seroval/security/advisories/G...
x_refsource_CONFIRM
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312...
x_refsource_MISC
https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.