CVE-2026-23737: seroval Library RCE Vulnerability

CVE-2026-23737 Overview

CVE-2026-23737 is an insecure deserialization vulnerability in seroval, a JavaScript library that facilitates value stringification for complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution through overriding constant value and error deserialization mechanisms.

Critical Impact

Attackers can achieve arbitrary JavaScript code execution through indirect access to unsafe JS evaluation, potentially compromising server-side applications that use seroval for client-to-server data transmission.

Affected Products

• seroval versions 1.4.0 and below
• Applications using fromJSON function for deserialization
• Applications using fromCrossJSON function in client-to-server scenarios

Discovery Timeline

• 2026-01-21 - CVE CVE-2026-23737 published to NVD
• 2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23737

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw exists in the fromJSON and fromCrossJSON functions within seroval's deserialization component. When processing serialized data from untrusted sources, the library fails to properly validate input before reconstructing JavaScript objects. This enables attackers to craft malicious payloads that, when deserialized, can override constant values and error handling mechanisms to achieve indirect code execution.

The attack requires network access and low privileges, but has high complexity requirements. Attackers need the ability to perform at least 4 separate requests on the same function and must possess partial knowledge of how the serialized data is used during later runtime processing.

Root Cause

The root cause is improper input handling during JSON deserialization. The seroval library's reconstruction of complex JavaScript structures from serialized data does not adequately sanitize or validate the input before processing. This allows specially crafted payloads to manipulate the deserialization process, ultimately gaining access to unsafe JavaScript evaluation contexts.

Attack Vector

The attack is network-based and targets client-to-server transmission scenarios where seroval is used to deserialize incoming data. An attacker must:

1. Identify an endpoint using seroval's fromJSON or fromCrossJSON functions
2. Craft a malicious serialized payload that exploits constant value and error deserialization overrides
3. Submit multiple requests (minimum of 4) to the same function to set up the exploitation chain
4. Leverage the deserialization flaw to achieve indirect access to JavaScript evaluation

The following patch was applied to address the vulnerability by modifying the base primitives handling:

     SerovalNodeType.RegExp,
     id,
     NIL,
-    NIL,
     serializeString(current.source),
     current.flags,
     NIL,

Source: GitHub Commit Update

Detection Methods for CVE-2026-23737

Indicators of Compromise

• Unusual patterns of multiple requests targeting the same deserialization endpoint
• Malformed or suspicious JSON payloads containing unexpected object structures
• Error logs indicating deserialization failures followed by successful code execution
• Anomalous server-side behavior after processing client-submitted serialized data

Detection Strategies

• Monitor for unusual request patterns involving 4+ sequential requests to seroval-dependent endpoints
• Implement application-level logging for fromJSON and fromCrossJSON function calls
• Deploy web application firewalls with rules to detect malicious serialization payloads
• Use runtime application self-protection (RASP) solutions to detect deserialization attacks

Monitoring Recommendations

• Enable detailed logging for all deserialization operations in applications using seroval
• Set up alerts for failed deserialization attempts followed by unexpected code execution paths
• Monitor for unusual JavaScript evaluation patterns in server-side runtime environments
• Implement network traffic analysis to identify exploitation attempt patterns

How to Mitigate CVE-2026-23737

Immediate Actions Required

• Upgrade seroval to version 1.4.1 or later immediately
• Review application code for usage of fromJSON and fromCrossJSON functions
• Implement input validation for all data passed to seroval deserialization functions
• Consider temporarily disabling client-to-server seroval deserialization if patching is delayed

Patch Information

The vulnerability has been fixed in seroval version 1.4.1. The patch modifies the base primitives handling to prevent the exploitation of constant value and error deserialization overrides. Organizations should update to the latest version by running npm update seroval or updating the dependency version in package.json.

For detailed patch information, see the GitHub Security Advisory GHSA-3rxj-6cgf-8cfw and the security patch commit.

Workarounds

• Avoid using fromJSON or fromCrossJSON with untrusted client input until patched
• Implement strict schema validation before passing data to seroval deserialization functions
• Use allowlisting to restrict acceptable object types during deserialization
• Consider alternative serialization libraries that do not have this vulnerability for critical applications

# Update seroval to patched version
npm update seroval

# Or specify minimum safe version in package.json
npm install seroval@^1.4.1