CVE-2026-23737: seroval Library RCE Vulnerability

CVE-2026-23737 Overview

CVE-2026-23737 is an insecure deserialization vulnerability in seroval, a JavaScript library that facilitates value stringification for complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution through overriding constant value and error deserialization mechanisms.

Critical Impact
Attackers can achieve arbitrary JavaScript code execution through indirect access to unsafe JS evaluation, potentially compromising server-side applications that use seroval for client-to-server data transmission.

Affected Products

seroval versions 1.4.0 and below
Applications using fromJSON function for deserialization
Applications using fromCrossJSON function in client-to-server scenarios

Discovery Timeline

2026-01-21 - CVE CVE-2026-23737 published to NVD
2026-01-21 - Last updated in NVD database

Technical Details for CVE-2026-23737

Vulnerability Analysis

This vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The flaw exists in the fromJSON and fromCrossJSON functions within seroval's deserialization component. When processing serialized data from untrusted sources, the library fails to properly validate input before reconstructing JavaScript objects. This enables attackers to craft malicious payloads that, when deserialized, can override constant values and error handling mechanisms to achieve indirect code execution.

The attack requires network access and low privileges, but has high complexity requirements. Attackers need the ability to perform at least 4 separate requests on the same function and must possess partial knowledge of how the serialized data is used during later runtime processing.

Root Cause

The root cause is improper input handling during JSON deserialization. The seroval library's reconstruction of complex JavaScript structures from serialized data does not adequately sanitize or validate the input before processing. This allows specially crafted payloads to manipulate the deserialization process, ultimately gaining access to unsafe JavaScript evaluation contexts.

Attack Vector

The attack is network-based and targets client-to-server transmission scenarios where seroval is used to deserialize incoming data. An attacker must:

Identify an endpoint using seroval's fromJSON or fromCrossJSON functions
Craft a malicious serialized payload that exploits constant value and error deserialization overrides
Submit multiple requests (minimum of 4) to the same function to set up the exploitation chain
Leverage the deserialization flaw to achieve indirect access to JavaScript evaluation

The following patch was applied to address the vulnerability by modifying the base primitives handling:

typescript

     SerovalNodeType.RegExp,
     id,
     NIL,
-    NIL,
     serializeString(current.source),
     current.flags,
     NIL,

Source: GitHub Commit Update

Detection Methods for CVE-2026-23737

Indicators of Compromise

Unusual patterns of multiple requests targeting the same deserialization endpoint
Malformed or suspicious JSON payloads containing unexpected object structures
Error logs indicating deserialization failures followed by successful code execution
Anomalous server-side behavior after processing client-submitted serialized data

Detection Strategies

Monitor for unusual request patterns involving 4+ sequential requests to seroval-dependent endpoints
Implement application-level logging for fromJSON and fromCrossJSON function calls
Deploy web application firewalls with rules to detect malicious serialization payloads
Use runtime application self-protection (RASP) solutions to detect deserialization attacks

Monitoring Recommendations

Enable detailed logging for all deserialization operations in applications using seroval
Set up alerts for failed deserialization attempts followed by unexpected code execution paths
Monitor for unusual JavaScript evaluation patterns in server-side runtime environments
Implement network traffic analysis to identify exploitation attempt patterns

How to Mitigate CVE-2026-23737

Immediate Actions Required

Upgrade seroval to version 1.4.1 or later immediately
Review application code for usage of fromJSON and fromCrossJSON functions
Implement input validation for all data passed to seroval deserialization functions
Consider temporarily disabling client-to-server seroval deserialization if patching is delayed

Patch Information

The vulnerability has been fixed in seroval version 1.4.1. The patch modifies the base primitives handling to prevent the exploitation of constant value and error deserialization overrides. Organizations should update to the latest version by running npm update seroval or updating the dependency version in package.json.

For detailed patch information, see the GitHub Security Advisory GHSA-3rxj-6cgf-8cfw and the security patch commit.

Workarounds

Avoid using fromJSON or fromCrossJSON with untrusted client input until patched
Implement strict schema validation before passing data to seroval deserialization functions
Use allowlisting to restrict acceptable object types during deserialization
Consider alternative serialization libraries that do not have this vulnerability for critical applications

bash

# Update seroval to patched version
npm update seroval

# Or specify minimum safe version in package.json
npm install seroval@^1.4.1