CVE-2026-23957
Published: 22 January 2026
Summary
CVE-2026-23957 is a high-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Lxsmnsyc Seroval. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2026-23957 is a denial-of-service vulnerability in the seroval JavaScript library, which enables serialization of JavaScript values including complex structures beyond standard JSON.stringify capabilities. In versions 1.4.0 and below, attackers can override encoded array lengths in serialized data by replacing them with excessively large values, causing the deserialization process to consume significant processing time due to resource exhaustion (CWE-770). The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Any remote, unauthenticated attacker can exploit this vulnerability by crafting and delivering malicious serialized payloads to applications that use affected seroval versions for deserialization. Successful exploitation leads to substantial increases in CPU usage during deserialization, potentially resulting in denial of service for the targeted application or service without requiring user interaction.
The issue has been addressed in seroval version 1.4.1. Official mitigation guidance is available in the GitHub security advisory at https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6 and the fixing commit at https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798060; security practitioners should upgrade to the patched version and validate input serialization/deserialization processes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-3668
Vulnerability details
seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has…
more
been fixed in version 1.4.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vuln enables remote unauthenticated exploitation of public-facing apps (T1190) via malicious serialized payloads, directly causing endpoint DoS through application/system exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely patching of known flaws like CVE-2026-23957 by upgrading seroval to version 1.4.1 to eliminate the deserialization resource exhaustion vulnerability.
Requires validation of serialized input payloads to reject those with overridden excessively large array lengths that trigger CPU exhaustion during seroval deserialization.
Implements protections against denial-of-service attacks, including resource limits to mitigate CPU exhaustion from malicious seroval deserialization payloads.