GHSA-hx9m-jf43-8ffrHighCVSS 7.5

seroval affected by Denial of Service via RegExp serialization

Published
January 21, 2026
Last Modified
May 20, 2026

🔗 CVE IDs covered (1)

📋 Description

Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).

Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.

🎯 Affected products1

  • npm/seroval:>= 0.2.0, <= 1.4.0

🔗 References (5)