7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23957

CVE-2026-23957: seroval is vulnerable to Denial of Service via array serialization

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23957

CVE-2026-23957:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
seroval	npm	<= 1.4.0	1.4.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the deserialization process of the seroval library, where it improperly trusts serialized length/size values for various data structures. An attacker can craft a serialized payload with an artificially large length value for an Array, Set, Map, or Object properties record, while providing only a small amount of actual data. When the library's deserialization functions (such as deserializeArray, deserializeSet, deserializeMap, and deserializeProperties) process this payload, they use the trusted large length value to control their processing loops. This leads to an excessive number of iterations, consuming significant CPU resources and blocking the Node.js event loop, resulting in a Denial of Service. The patch addresses this by removing the reliance on the serialized length and instead deriving the length directly from the count of the deserialized items, ensuring the loops only iterate over the data that is actually present.

Vulnerable functions

deserializeArray

packages/seroval/src/core/context/deserializer.ts

The function previously trusted the serialized length (`node.l`) from the input. An attacker could provide a very large value for `node.l` while `node.a` (the array of items) was small. The `for` loop would then iterate up to this large number, causing the event loop to be blocked and leading to a Denial of Service. The fix is to derive the length from the actual items array (`node.a.length`).

deserializeSet

packages/seroval/src/core/context/deserializer.ts

Similar to `deserializeArray`, this function was vulnerable because it trusted the serialized size of the Set (`node.l`). A large value would cause a long-running loop, leading to a DoS. The fix computes the length from the items array.

deserializeMap

packages/seroval/src/core/context/deserializer.ts

This function was vulnerable because it trusted the serialized size of the Map (`node.e.s`). A large value would cause a long-running loop, leading to a DoS. The fix computes the length from the keys array.

deserializeProperties

packages/seroval/src/core/context/deserializer.ts

This function was vulnerable because it trusted the serialized size of the object's properties (`node.s`). A large value would cause a long-running loop, leading to a DoS. The fix computes the length from the keys array.

ARRAY_BUFFER_CONSTRUCTOR

packages/seroval/src/core/constructors.ts

This function was called by `deserializeArrayBuffer` and was passed a `length` parameter that was read from the serialized data. The function used this length to allocate a `Uint8Array` and in its processing loop. A large `length` value could cause excessive allocation and processing time, leading to a DoS. The fix removes the `length` parameter and calculates it from the provided base64 string.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.