CVE-2026-23956 Overview
CVE-2026-23956 affects seroval, a JavaScript library that stringifies complex values beyond JSON.stringify capabilities. Versions 1.4.0 and below allow attackers to override RegExp serialization with extremely large patterns. This exhausts JavaScript runtime memory during deserialization. Attackers can also supply patterns that trigger catastrophic backtracking, causing Regular Expression Denial of Service (ReDoS). The maintainer addressed the issue in version 1.4.1. The flaw maps to CWE-1333: Inefficient Regular Expression Complexity.
Critical Impact
A remote, unauthenticated attacker can crash or stall any Node.js service that deserializes attacker-influenced seroval payloads, producing sustained denial of service.
Affected Products
- lxsmnsyc/seroval versions <= 1.4.0
- Node.js applications that deserialize untrusted seroval-encoded input
- Downstream frameworks and libraries that embed seroval for state hydration
Discovery Timeline
- 2026-01-22 - CVE-2026-23956 published to NVD
- 2026-02-27 - Last updated in NVD database
Technical Details for CVE-2026-23956
Vulnerability Analysis
seroval extends standard JSON serialization to support complex JavaScript values, including RegExp objects. The deserialization path reconstructs RegExp instances from serialized patterns supplied by the producer. The library performs no length or complexity validation on the pattern source before invoking the RegExp constructor. An attacker who controls a serialized payload can substitute the pattern field with hostile content. Two failure modes result.
The first failure mode allocates oversized pattern strings. The JavaScript engine consumes all available heap when compiling or storing the regular expression. The process terminates with an out-of-memory error.
The second failure mode embeds a pattern with nested quantifiers or overlapping alternations. When the deserialized RegExp later evaluates input, the matcher enters exponential backtracking. The event loop blocks, and the Node.js process stops servicing requests.
Root Cause
The root cause is missing input validation in the RegExp deserialization handler. seroval trusts the serialized pattern and flags without enforcing maximum length, structural complexity, or a safe regex compilation policy. This is a classic CWE-1333 pattern where user-controlled regular expression sources flow into a backtracking matcher.
Attack Vector
The attack is network-reachable and requires no authentication or user interaction. An attacker submits a crafted serialized payload to any endpoint that calls seroval deserialization on the input. Examples include server-side rendering hydration, RPC framing, or cache restoration. The payload either exhausts memory immediately or plants a malicious RegExp whose impact triggers on subsequent matching. Confidentiality and integrity are unaffected; only availability is impacted.
No public proof-of-concept code is referenced in the advisory. See the GitHub Security Advisory GHSA-hx9m-jf43-8ffr for maintainer-provided technical details.
Detection Methods for CVE-2026-23956
Indicators of Compromise
- Node.js processes terminating with JavaScript heap out of memory errors near seroval deserialization frames
- Sustained 100% CPU on a single event-loop thread following ingestion of external serialized state
- HTTP request payloads containing unusually large RegExp pattern fields in seroval envelopes
- Application logs showing repeated timeouts on endpoints that hydrate serialized server state
Detection Strategies
- Inventory dependencies with npm ls seroval and flag any version at or below 1.4.0
- Inspect application code paths that call seroval deserialization on data sourced from HTTP, message queues, or caches
- Add request-size limits and content inspection at the ingress layer to surface oversized serialized payloads
- Correlate process restart events with upstream request signatures to identify abuse patterns
Monitoring Recommendations
- Track Node.js heap usage, event-loop lag, and process restart counters per service instance
- Alert on regex evaluation durations exceeding a defined threshold using async hooks or APM instrumentation
- Forward Node.js crash logs and APM traces into a centralized analytics platform for cross-service correlation
- Monitor outbound dependency advisories for seroval and transitive consumers
How to Mitigate CVE-2026-23956
Immediate Actions Required
- Upgrade seroval to version 1.4.1 or later across all services and build artifacts
- Audit transitive dependencies with npm ls seroval and rebuild lockfiles to enforce the patched version
- Restrict deserialization of seroval payloads to trusted producers where feasible
- Apply request body size limits and timeouts to endpoints that consume serialized state
Patch Information
The maintainer fixed the issue in seroval1.4.1. The corrective change is published in commit ce9408ebc87312fcad345a73c172212f2a798060 and described in GHSA-hx9m-jf43-8ffr. Upgrade with npm install seroval@^1.4.1 or the equivalent command for your package manager.
Workarounds
- Reject inbound seroval payloads above a strict byte threshold at the reverse proxy or API gateway
- Validate that deserialized values do not include attacker-controlled RegExp instances before use in matching operations
- Execute deserialization in worker threads with bounded memory and CPU time so a single payload cannot stall the main event loop
- Replace seroval with JSON.parse for code paths that do not require complex value support until patching completes
# Configuration example
npm install seroval@^1.4.1
npm ls seroval
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.