seroval Affected by Prototype Pollution via JSON Deserialization

Description

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This affects only JSON deserialization functionality.

As there is no known workaround, please upgrade to the latest version.

Recommendation

Update the seroval package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-hj76-42vx-jwp4
• CVE-2026-23736
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Server secret was included in static assets and served to clients - Vulnerability
• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• Seroval affected by Denial of Service via Array serialization - CVE-2026-23957
• seroval affected by Denial of Service via RegExp serialization - CVE-2026-23956

Tags:

npm

seroval