CVE-2026-23957 — HIGH (7.5)

Q: How severe is CVE-2026-23957?

CVE-2026-23957 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-23957?

Check the references section above for vendor advisories and patch information. Affected products include: Lxsmnsyc Seroval.

Vulnerability Description

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

CVSS Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

HIGH

Affected Products

Vendor	Product	Versions
Lxsmnsyc	Seroval	< 1.4.1

Related Weaknesses (CWE)

CWE-770

References

https://github.com/lxsmnsyc/seroval/commit/ce9408ebc87312fcad345a73c172212f2a798Patch
https://github.com/lxsmnsyc/seroval/security/advisories/GHSA-66fc-rw6m-c2q6MitigationVendor Advisory

FAQ

What is CVE-2026-23957?

CVE-2026-23957 is a vulnerability with a CVSS score of 7.5 (HIGH). seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an e...

How severe is CVE-2026-23957?

CVE-2026-23957 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-23957?

Check the references section above for vendor advisories and patch information. Affected products include: Lxsmnsyc Seroval.