CVE-2026-23956

Katalog CVE

CVSS 7.5 · High EPSS 0,55%

Kerentanan Inefficient Regular Expression Complexity pada lxsmnsyc seroval. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

Rincian

Terbit di NVD

22 Januari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1333: Inefficient Regular Expression Complexity

EPSS (30 hari)

0,55% peluang dieksploitasi; lebih tinggi dari 44,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-hx9m-jf43-8ffr mitigasi · advisory vendor
• https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 patch
• https://github.com/lxsmnsyc/seroval/blob/v0.2.0/packages/seroval/src/index.ts#L90