seroval Affected by Prototype Pollution via JSON Deserialization

Description

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This affects only JSON deserialization functionality.

As there is no known workaround, please upgrade to the latest version.

Recommendation

Update the seroval package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-hj76-42vx-jwp4
• CVE-2026-23736
• CWE-1321
• CAPEC-310
• OWASP 2021-A6

Related Issues

• seroval Affected by Remote Code Execution via JSON Deserialization - CVE-2026-23737
• seroval affected by Denial of Service via RegExp serialization - CVE-2026-23956
• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• Parse Server vulnerable to schema poisoning via prototype pollution in deep copy - CVE-2026-32878

Tags:

npm

seroval