CVE-2026-23736

CVE-2026-23736 is a vulnerability in the seroval JavaScript library, which enables stringification of JavaScript values including complex structures beyond standard JSON.stringify capabilities. In versions 1.4.0 and below, improper input validation allows a malicious object key to cause prototype pollution during JSON deserialization. This issue is limited to the JSON deserialization functionality and is associated with CWE-1321. The vulnerability received a CVSS v3.1 base score of 7.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) and was published on 2026-01-21.

A remote, unauthenticated attacker can exploit this vulnerability by supplying malicious input to an affected seroval JSON deserialization operation. Successful exploitation leads to prototype pollution, where the attacker can modify properties on Object.prototype, potentially enabling further attacks such as denial of service, information disclosure, or code execution depending on the application's use of polluted prototypes. The low complexity and lack of privileges required make it accessible to attackers targeting applications that process untrusted JSON inputs with vulnerable seroval versions.

The seroval security advisory (GHSA-hj76-42vx-jwp4) and corresponding commit (ce9408ebc87312fcad345a73c172212f2a798060) confirm the issue is fixed in version 1.4.1 through improved input validation. Security practitioners should upgrade to seroval 1.4.1 or later and review applications for unsafe deserialization of untrusted JSON inputs using this library.