CVE-2026-23736: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23736 is a prototype pollution vulnerability in the seroval npm package (Node.js) caused by improper input validation during JSON deserialization. A malicious object key supplied during deserialization can corrupt JavaScript object prototypes, potentially enabling arbitrary code execution, data manipulation, or denial of service. The vulnerability affects all versions of seroval up to and including 1.4.0, and was disclosed on January 21, 2026. The GitHub Advisory (GHSA-hj76-42vx-jwp4) assigns a CVSS v3.1 score of 7.3 (High), while Feedly's estimate places it at 9.8 (Critical) (Github Advisory, Red Hat Bugzilla).

The root cause is improper input validation (CWE-1321: Improperly Controlled Modification of Object Prototype Attributes) in seroval's JSON deserialization code path. When deserializing JSON, the library fails to sanitize or reject specially crafted object keys such as __proto__, constructor, or prototype, allowing an attacker to inject properties into the global JavaScript object prototype. This attack is network-accessible, requires no authentication or user interaction, and has low attack complexity — any application that passes untrusted JSON input through seroval's deserialization functions is at risk. The vulnerability is isolated to JSON deserialization functionality and does not affect serialization (Github Advisory, Red Hat Bugzilla).

Successful exploitation can result in prototype pollution of the Node.js application's JavaScript runtime environment, which may lead to arbitrary code execution, unauthorized data manipulation, or denial of service depending on how the polluted prototype properties are subsequently used by the application. Because prototype pollution affects the shared Object.prototype, all objects in the application may inherit the injected properties, potentially enabling privilege escalation, security control bypass, or application crashes. The confidentiality, integrity, and availability impacts are all rated as present, with the scope limited to the affected component (Github Advisory, Red Hat Bugzilla).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Github Advisory). The EPSS score is approximately 0.033% (0.333% per the GitHub Advisory, 56th percentile), indicating a relatively low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported. However, the attack requires no privileges or user interaction and is remotely exploitable, making it straightforward to attempt if a PoC becomes available.

1. Identify target: Locate a Node.js application that uses the seroval package (versions ≤ 1.4.0) and exposes a JSON deserialization endpoint that accepts user-controlled input.
2. Craft malicious payload: Construct a JSON object containing a specially crafted key such as __proto__, constructor, or prototype with a nested property intended to pollute the prototype chain. For example:

   {"__proto__": {"polluted": "injected_value"}}

3. Submit payload: Send the crafted JSON to the application endpoint that invokes seroval's JSON deserialization function (e.g., via an HTTP POST request with Content-Type: application/json).
4. Trigger prototype pollution: The seroval deserializer processes the malicious key without sanitization, causing the injected property to be assigned to Object.prototype, affecting all objects in the runtime.
5. Achieve objective: Depending on the application logic, the polluted prototype may bypass security checks, alter application behavior, trigger code execution via gadget chains, or cause a denial of service through unexpected property access (Github Advisory, Red Hat Bugzilla).

• Network: Unexpected or malformed JSON POST requests to application endpoints containing keys such as __proto__, constructor, or prototype in the request body.
• Logs: Application error logs showing unexpected property access patterns or type errors related to prototype chain modifications; Node.js process logs indicating unusual object behavior.
• Application Behavior: Unexpected properties appearing on plain objects throughout the application (e.g., ({}).polluted returning a non-undefined value); security controls or access checks behaving inconsistently.
• Process: Unusual child processes spawned by the Node.js application process; unexpected outbound network connections following JSON deserialization operations.

The vendor has released seroval version 1.4.1 as the fix for this vulnerability. No configuration-based workarounds are available — the advisory explicitly states there is no known workaround, making upgrading to 1.4.1 or later the only viable remediation. Organizations should audit their package.json and lock files for any dependency on seroval ≤ 1.4.0 and update immediately using npm install seroval@latest, yarn upgrade seroval, or pnpm update seroval (Github Advisory, Patch Commit).

The vulnerability was coordinated and disclosed by the package maintainer (lxsmnsyc) with credited coordination from tweidinger. Red Hat tracked the issue via their security response process (Bugzilla Bug 2431898) and classified it as high priority/severity. No significant broader media coverage or notable researcher commentary beyond the standard advisory channels has been identified (Github Advisory, Red Hat Bugzilla).