GHSA-hj76-42vx-jwp4: seroval Affected by Prototype Pollution via JSON Deserialization

Skip to content

Navigation Menu

• • AI CODE CREATION

    • GitHub CopilotWrite better code with AI

    • GitHub SparkBuild and deploy intelligent apps

    • GitHub ModelsManage and compare prompts

    • MCP RegistryNewIntegrate external tools

View all features

• Pricing

Provide feedback

Saved searches****Use saved searches to filter your results more quickly

Sign up

Appearance settings

1. GitHub Advisory Database
2. GitHub Reviewed
3. CVE-2026-23736

seroval Affected by Prototype Pollution via JSON Deserialization

High severity GitHub Reviewed Published Jan 21, 2026 in lxsmnsyc/seroval • Updated Jan 21, 2026

Package

npm seroval (npm)

Affected versions

< 1.4.1

Description

Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.
This affects only JSON deserialization functionality.

As there is no known workaround, please upgrade to the latest version.

References

• GHSA-hj76-42vx-jwp4
• lxsmnsyc/seroval@ce9408e

Published to the GitHub Advisory Database

Jan 21, 2026

Last updated

Jan 21, 2026

EPSS score