CVE-2026-23956

{"id": "CVE-2026-23956", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-01-22T02:15:52.310", "references": [{"url": "https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90", "source": "security-advisories@github.com"}, {"url": "https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-1333"}]}], "descriptions": [{"lang": "en", "value": "seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1."}, {"lang": "es", "value": "seroval facilita la serializaci\u00f3n de valores JS, incluyendo estructuras complejas que van m\u00e1s all\u00e1 de las capacidades de JSON.stringify. En las versiones 1.4.0 y anteriores, la anulaci\u00f3n de la serializaci\u00f3n de RegExp con patrones extremadamente grandes puede agotar la memoria en tiempo de ejecuci\u00f3n de JavaScript durante la deserializaci\u00f3n. Adem\u00e1s, la anulaci\u00f3n de la serializaci\u00f3n de RegExp con patrones que desencadenan un retroceso catastr\u00f3fico puede conducir a ReDoS (Denegaci\u00f3n de Servicio por Expresiones Regulares). Este problema ha sido solucionado en la versi\u00f3n 1.4.1."}], "lastModified": "2026-05-20T02:16:35.403", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "85760E40-9AB1-40EB-98A1-D1A4411AAFC5", "versionEndExcluding": "1.4.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}