seroval Affected by Remote Code Execution via JSON Deserialization

Description

Improper input handling in the JSON deserialization component can lead to arbitrary JavaScript code execution.

The vulnerability can be exploited via overriding constant value and error deserialization, which allows indirect access to unsafe JS evaluation.

Recommendation

Update the seroval package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-3rxj-6cgf-8cfw
• CVE-2026-23737
• CWE-502
• CAPEC-310
• OWASP 2021-A6
• OWASP 2021-A8

Related Issues

• Seroval affected by Denial of Service via Deeply Nested Objects - CVE-2026-24006
• seroval affected by Denial of Service via RegExp serialization - CVE-2026-23956
• seroval Affected by Prototype Pollution via JSON Deserialization - CVE-2026-23736
• Linkify Allows Prototype Pollution & HTML Attribute Injection (XSS) - CVE-2025-8101

Tags:

npm

seroval