CVE-2026-23956: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23956 is a Denial of Service vulnerability in the seroval npm package (a JavaScript value serialization library) caused by unsafe RegExp deserialization. Attackers can craft malicious serialized RegExp patterns that either exhaust JavaScript runtime memory via extremely large patterns or trigger catastrophic backtracking (ReDoS). All versions from 0.2.0 through 1.4.0 are affected; the vulnerability was disclosed on January 21, 2026, and patched in version 1.4.1. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Seroval Advisory).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity). Seroval's deserialization logic, present since v0.2.0, evaluates serialized JavaScript values including RegExp objects without imposing size or complexity constraints on the patterns (Github Advisory). An attacker who can supply crafted serialized input to a Seroval deserialization call can exploit this via two vectors: (1) submitting an extremely large RegExp pattern to exhaust heap memory, or (2) submitting a pattern with exponential backtracking complexity to monopolize CPU cycles (ReDoS). No authentication or user interaction is required — the only precondition is that the application passes attacker-controlled data to Seroval's deserialization methods (Seroval Advisory).

Successful exploitation results in a complete loss of availability for the affected Node.js application — either through memory exhaustion causing an out-of-memory crash or through CPU starvation causing the event loop to hang indefinitely. There is no impact on confidentiality or data integrity. Applications that deserialize user-supplied data using Seroval are at risk of service disruption without any attacker privileges, making this particularly dangerous in public-facing APIs or server-side rendering pipelines (Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.036–0.068%, placing it in the lower percentiles for near-term exploitation likelihood (Github Advisory). No threat actor attribution has been reported.

1. Identify target: Locate a Node.js application that uses seroval versions 0.2.0–1.4.0 and passes externally-supplied data to a Seroval deserialization method (e.g., deserialize(), fromJSON(), or stream-based equivalents).
2. Craft a memory-exhaustion payload: Construct a serialized Seroval string containing a RegExp node with an extremely large pattern (e.g., a pattern string of several megabytes or gigabytes in length) to exhaust the JavaScript heap during deserialization.
3. Craft a ReDoS payload (alternative): Construct a serialized Seroval string containing a RegExp with a catastrophically backtracking pattern (e.g., /(a+)+$/) paired with a carefully chosen input string that triggers exponential backtracking in the JavaScript regex engine.
4. Submit the payload: Send the crafted serialized string to the target application endpoint that invokes Seroval deserialization, such as an HTTP API body, WebSocket message, or server-side rendering data channel.
5. Achieve DoS: The JavaScript runtime either runs out of memory and crashes, or the event loop is blocked indefinitely by regex evaluation, rendering the application unavailable (Seroval Advisory).

• Logs: Node.js process crash logs showing JavaScript heap out of memory or unresponsive event loop warnings coinciding with deserialization calls; application error logs referencing Seroval deserialization functions.
• Process: Node.js process consuming 100% CPU for extended periods without completing a request; process memory usage growing unboundedly until OOM kill.
• Network: Unusually large request bodies (megabytes or more) sent to endpoints that accept serialized JavaScript data; repeated requests with similar oversized or pattern-heavy payloads from the same source IP.
• Application: Increased rate of application crashes or restarts (e.g., PM2/systemd restart logs) without corresponding infrastructure issues.

Upgrade seroval to version 1.4.1 or later, which introduces the disabledFeatures bitmask parameter in serialization and deserialization methods (Seroval Commit). As an immediate workaround prior to upgrading, configure disabledFeatures with the Feature.RegExp flag to disable RegExp serialization and deserialization entirely, eliminating the attack surface (Seroval Advisory). Additionally, applications should validate and sanitize any externally-supplied data before passing it to Seroval deserialization methods, and consider enforcing request body size limits at the network or application layer.

The vulnerability was credited to researcher tweidinger and coordinated by the library author lxsmnsyc, who published the advisory and patch on January 21, 2026 (Seroval Advisory). Red Hat acknowledged the CVE on January 22, 2026 (Red Hat CVE). Community reaction has been limited given the moderate scope of the library; no significant media coverage or notable researcher commentary beyond the advisory itself has been identified.