CVE-2026-23957

seroval is vulnerable to Denial of Service via array serialization

7.5 HighFix available

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.44%Up 0.4 points since Jan 22, 2026

What each source reports

CVE List Score used 7.5

seroval is vulnerable to Denial of Service via array serialization

Record: CVE-2026-23957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

EUVDEUVD-2026-3668 7.5

Record: EUVD-2026-3668
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-66fc-rw6m-c2q6 7.5

Seroval affected by Denial of Service via Array serialization

Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.

Mitigation:
Seroval no longer encodes array lengths. Instead, it computes length using Array.prototype.length during deserialization.

Record: GHSA-66fc-rw6m-c2q6
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-23957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSV 7.5

seroval is vulnerable to Denial of Service via array serialization

Record: CVE-2026-23957
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

OSVGHSA-66fc-rw6m-c2q6 7.5

Seroval affected by Denial of Service via Array serialization

Overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time.

Mitigation:
Seroval no longer encodes array lengths. Instead, it computes length using Array.prototype.length during deserialization.

Record: GHSA-66fc-rw6m-c2q6
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-770
Updated: 2026-11-02

Affected products

lxsmnsyc seroval

Affected packages

Affected packages
Package	Affected	Fixed
`seroval` npm	through 1.4.0	1.4.1
`seroval` npm	before 1.4.1	1.4.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-23957 is a high vulnerability (CVSS 7.5) in Lxsmnsyc Seroval, published January 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in seroval 1.4.1.