CVE-2026-23957

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23957
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 Patch
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*
History

06 Apr 2026, 13:51

Type Values Removed Values Added
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:* cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:node.js:*:*
Summary
  • (es) seroval facilita la serialización de valores JS, incluyendo estructuras complejas más allá de las capacidades de JSON.stringify. En las versiones 1.4.0 e inferiores, la anulación de las longitudes de arrays codificados al reemplazarlas con un valor excesivamente grande provoca que el proceso de deserialización aumente significativamente el tiempo de procesamiento. Este problema ha sido solucionado en la versión 1.4.1.

27 Feb 2026, 14:49

Type Values Removed Values Added
References () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - Patch
References () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 - () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 - Mitigation, Vendor Advisory
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*
First Time Lxsmnsyc seroval
Lxsmnsyc

22 Jan 2026, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 02:15

Updated : 2026-04-06 13:51

NVD link : CVE-2026-23957

Mitre link : CVE-2026-23957

CVE.ORG link : CVE-2026-23957

JSON object : View

Products Affected

lxsmnsyc

  • seroval
CWE
CWE-770

Allocation of Resources Without Limits or Throttling