CVE-2026-23957

  1. Yack CVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23957

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

s

eroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

References
Link Resource
https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 Patch
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 Mitigation Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*
History

27 Feb 2026, 14:49

Type Values Removed Values Added
First Time Lxsmnsyc seroval
Lxsmnsyc
References () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - () https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060 - Patch
References () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 - () https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 - Mitigation, Vendor Advisory
CPE cpe:2.3:a:lxsmnsyc:seroval:*:*:*:*:*:*:*:*

22 Jan 2026, 02:15

Type Values Removed Values Added
New CVE
Information

Published : 2026-01-22 02:15

Updated : 2026-02-27 14:49

NVD link : CVE-2026-23957

Mitre link : CVE-2026-23957

CVE.ORG link : CVE-2026-23957

JSON object : View

Products Affected

lxsmnsyc

CWE
CWE-770

Allocation of Resources Without Limits or Throttling