~ / search / GHSA-hx9m-jf43-8ffr

GHSA-hx9m-jf43-8ffr

seroval affected by Denial of Service via RegExp serialization

Source: GitHub Advisory Database (reviewed) High CVE-2026-23956

Packages

EcosystemPackageAffectedFixed in
npm seroval >= 0.2.0, < 1.4.1 1.4.1

Details

As written in the advisory (Markdown source, shown as plain text).

Overriding RegExp serialization with extremely large patterns can **exhaust JavaScript runtime memory** during deserialization. Additionally, overriding RegExp serialization with patterns that trigger **catastrophic backtracking** can lead to ReDoS (Regular Expression Denial of Service). **Mitigation**: `Seroval` introduces `disabledFeatures` (a bitmask) in serialization/deserialization methods, with `Feature.RegExp` as a dedicated flag. **Users are recommended to configure `disabledFeatures` to disable RegExp serialization entirely.**

References

External links from the advisory. They lead to third-party sites.