CVE-2026-23737: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23737 is a Remote Code Execution (RCE) vulnerability in the seroval npm package (a JavaScript value stringification library) caused by improper input handling in its JSON deserialization component. It affects all versions of seroval up to and including 1.4.0 for Node.js. The vulnerability was published on January 21, 2026, with a patch released in version 1.4.1. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-502: Deserialization of Untrusted Data; also classified under CWE-20: Improper Input Validation) in the fromJSON and fromCrossJSON functions, which are used in client-to-server transmission scenarios. An attacker can exploit this by overriding constant values and manipulating error deserialization to gain indirect access to unsafe JavaScript eval-equivalent execution paths. Exploitation requires at minimum 4 separate requests to the same server-side function and partial knowledge of how the serialized data is consumed during runtime processing, making it a multi-step, high-complexity attack. The fix was committed in seroval@ce9408e and released as versions 1.4.1 and 1.4.2 (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation allows an authenticated (low-privilege) remote attacker to execute arbitrary JavaScript code on the server processing the deserialized data, resulting in high confidentiality, integrity, and availability impact. This could enable full server compromise, data exfiltration, modification of application state, or denial of service. Applications using seroval's fromJSON or fromCrossJSON APIs to process untrusted client-supplied data are directly at risk (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires low privileges and no user interaction, but has high attack complexity due to the need for at least 4 coordinated requests and partial knowledge of server-side runtime behavior. The EPSS score is approximately 0.071% (0.00071), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. It was detected by Qualys scanner (detection ID 5007119) (GitHub Advisory, Feedly).

1. Reconnaissance: Identify applications using seroval versions ≤1.4.0 that expose server-side endpoints invoking fromJSON or fromCrossJSON with client-supplied data (e.g., via npm audit, dependency scanning, or inspecting public package manifests).
2. Understand serialization schema: Gain partial knowledge of how the target application uses the deserialized output at runtime — this may involve probing API responses, reviewing client-side JavaScript bundles, or analyzing error messages.
3. Override constant values: Craft a malicious serialized JSON payload that overrides internal constant values used by seroval's deserialization logic, exploiting the lack of input validation.
4. Trigger error deserialization path: Send a sequence of at least 4 crafted requests to the same server-side function, progressively manipulating the deserialization state to reach the unsafe JS evaluation code path.
5. Achieve code execution: The final crafted payload causes the server to evaluate attacker-controlled JavaScript, enabling arbitrary command execution, data exfiltration, or further lateral movement within the server environment (GitHub Advisory, Red Hat Bugzilla).

• Network: Repeated requests (minimum 4) to the same API endpoint in rapid succession with structurally unusual or oversized JSON payloads; unexpected outbound connections from the Node.js server process.
• Logs: Server-side errors or stack traces referencing fromJSON or fromCrossJSON in seroval; unexpected JavaScript evaluation errors or uncaught exceptions in application logs.
• Process: Unusual child processes spawned by the Node.js application process (e.g., sh, bash, curl, wget); unexpected file writes or network connections initiated by the application.
• File System: New or modified files in the application directory created by the Node.js process user; unexpected scripts or binaries dropped in writable directories.

Upgrade seroval to version 1.4.1 or later (versions 1.4.1 and 1.4.2 both contain the security fix). No configuration-based workarounds are available — the advisory explicitly states no known workarounds or mitigations exist other than upgrading. Operators should audit all dependencies using npm audit or equivalent tooling and prioritize updating any application that passes client-supplied data to fromJSON or fromCrossJSON (GitHub Advisory, seroval commit).

The vulnerability received brief coverage from automated security feeds and community aggregators including The Hacker Wire (Mastodon and Bluesky posts), CIRCL vulnerability database, and INCIBE-CERT. Red Hat opened a Bugzilla tracking entry (Bug 2431896) indicating awareness within the Red Hat ecosystem. No significant independent researcher commentary or major media coverage has been identified beyond standard advisory syndication (Red Hat Bugzilla).