GHSA-hj76-42vx-jwp4

seroval Affected by Prototype Pollution via JSON Deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2026-23736

Packages

Ecosystem	Package	Affected	Fixed in
npm	seroval	< 1.4.1	1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This affects only JSON deserialization functionality. As there is no known workaround, please upgrade to the latest version.

References

External links from the advisory. They lead to third-party sites.

https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hj76-42vx-jwp4 web
https://nvd.nist.gov/vuln/detail/CVE-2026-23736 advisory
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 web
https://github.com/lxsmnsyc/seroval package