CVE-2026-23956

RegExhaustion: Crashing Seroval with Malicious Patterns

Alon Barad
Alon Barad
Software Engineer

Jan 21, 2026·5 min read·6 visits

Executive Summary (TL;DR)

Seroval didn't check the size or complexity of Regular Expressions during deserialization. Attackers can send a JSON payload containing a 'bomb'—either a massive string to crash memory or a ReDoS pattern to spike CPU—taking down the Node.js process instantly.

A resource exhaustion vulnerability in the `seroval` JavaScript serialization library allows attackers to trigger Denial of Service (DoS) via malicious RegExp payloads. By exploiting the lack of input validation on deserialized RegExp strings, attackers can force the server into catastrophic backtracking or Out-of-Memory (OOM) states.

Fix Analysis (1)

Technical Appendix

CVSS Score
7.5/ 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Probability
0.12%
Top 100% most exploited

Affected Systems

Node.js applications using serovalServer-Side Rendering (SSR) frameworks utilizing seroval for hydrationApplications deserializing untrusted state using seroval

Affected Versions Detail

Product
Affected Versions
Fixed Version
seroval
lxsmnsyc
< 1.4.11.4.1
AttributeDetail
CWE IDCWE-400 (Uncontrolled Resource Consumption)
Attack VectorNetwork (JSON Payload)
CVSS7.5 (High)
ImpactDenial of Service (DoS)
Exploit StatusPoC Available
Key FixFeature Flags + Length Limits
CWE-400
Uncontrolled Resource Consumption

The product does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

Vulnerability Timeline

Fix commit pushed to repository
2026-01-21
Versions 1.4.1 and 1.4.2 released
2026-01-21
Vulnerability publicly disclosed
2026-01-21

Subscribe to updates

Get the latest CVE analysis reports delivered to your inbox.