7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23737

CVE-2026-23737: seroval Affected by Remote Code Execution via JSON Deserialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution. Exploitation is possible via overriding constant value and error deserialization, allowing indirect access to unsafe JS evaluation. At minimum, attackers need the ability to perform 4 separate requests on the same function, and partial knowledge of how the serialized data is used during later runtime processing. This vulnerability affects the fromJSON and fromCrossJSON functions in a client-to-server transmission scenario. This issue has been fixed in version 1.4.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23737

CVE-2026-23737:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
seroval	npm	< 1.4.1	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a prototype pollution issue within the seroval library's deserialization logic. The root cause lies in the deserializeProperties function, which, prior to the patch, failed to sanitize property keys before assigning them to a JavaScript object. This allowed a malicious actor to craft a serialized payload with a key of __proto__, which would then modify the Object.prototype.

Once the Object.prototype is polluted, an attacker can introduce properties that can be triggered by other parts of the application, leading to Remote Code Execution. The vulnerability description mentions that this can be achieved by overriding constant values and through error deserialization, which points to the involvement of deserializeConstant and deserializeError in the exploit chain.

The patch addresses this vulnerability by introducing several security enhancements:

Key Sanitization: A new isValidKey function is used to check for and disallow malicious keys like __proto__, constructor, and prototype during property assignment.
Depth Limiting: A recursion depth limit is introduced in the deserialization functions to prevent stack exhaustion attacks from deeply nested objects.
Hardened Deserialization: Functions like deserializeDictionary were updated to use Object.defineProperties instead of Object.assign to avoid triggering potentially malicious setters on the prototype chain.
Input Validation: Additional checks were added to validate the length of BigInt, RegExp, and base64 encoded ArrayBuffer data to prevent resource exhaustion.

The identified vulnerable functions are all part of the deserialization process that would be triggered when an application uses fromJSON or fromCrossJSON to process untrusted data.

Vulnerable functions

fromJSON

packages/seroval/src/core/tree/index.ts

This is a primary entry point for deserialization. It takes the serialized JSON and initiates the deserialization process, which includes the vulnerable `deserializeProperties` function. The patch adds feature flags to disable potentially dangerous deserialization features.

fromCrossJSON

packages/seroval/src/core/cross/index.ts

This is another primary entry point for deserialization. It takes a serialized node and initiates the deserialization process, which includes the vulnerable `deserializeProperties` function. The patch adds feature flags to disable potentially dangerous deserialization features.

deserialize

packages/seroval/src/core/context/deserializer.ts

This is the main recursive deserialization function that processes different types of nodes. It is vulnerable because it can be forced into a deep recursion, and it calls other vulnerable functions like `deserializeObject`.

deserializeProperties

packages/seroval/src/core/context/deserializer.ts

This function is at the core of the vulnerability. Before the patch, it directly assigned deserialized properties to an object without validating the keys. This allowed an attacker to use keys like `__proto__` to pollute `Object.prototype`, leading to Remote Code Execution.

deserializeObject

packages/seroval/src/core/context/deserializer.ts

This function is responsible for deserializing plain objects. It calls the vulnerable `deserializeProperties` function to set the object's properties, making it a key part of the exploitation chain.

deserializeError

packages/seroval/src/core/context/deserializer.ts

This function deserializes Error objects. It calls `deserializeDictionary`, which in turn calls the vulnerable `deserializeProperties`. The vulnerability description explicitly mentions error deserialization as part of the exploit.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.