7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23956

CVE-2026-23956: seroval affected by Denial of Service via RegExp serialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23956

CVE-2026-23956:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
seroval	npm	<= 1.4.0	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the deserialization of RegExp objects within the seroval library. The core of the issue is in the deserializeRegExp function, which, before the patch, would create a RegExp object from a serialized string without any checks on the string's length or complexity. This allows an attacker to craft a malicious payload with either an extremely long regular expression pattern to exhaust memory, or a pattern designed to cause catastrophic backtracking (ReDoS), effectively causing a Denial of Service.

The patch addresses this by introducing two main changes. First, it adds a feature flag, Feature.RegExp, which allows users to disable the serialization and deserialization of RegExp objects altogether via a disabledFeatures option in the main API functions like fromJSON and fromCrossJSON. Second, it introduces a length check (MAX_REGEXP_SOURCE_LENGTH) within the deserializeRegExp function to prevent the creation of overly large regular expressions even when the feature is enabled. The vulnerable functions identified are the entry points (fromJSON, fromCrossJSON) that accept the malicious data, the main deserialization dispatcher (deserialize), and the function where the vulnerable action occurs (deserializeRegExp).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.