CVE-2026-23736 is a high severity prototype pollution flaw (CVSS 7.3) in seroval, a JavaScript library that stringifies complex values beyond what JSON handles. A malicious object key can pollute prototypes during JSON deserialization. Versions up to 1.4.0 are affected, and seroval 1.4.1 fixes it.
What's affected
The GitHub advisory lists seroval up to and including 1.4.0 as affected, and 1.4.1 as the patched version. The advisory says there is no known workaround, so upgrade.
It also says only the JSON deserialization functionality is affected. If you use only other parts of the library, the described exposure is narrower, but upgrading still removes doubt.
seroval is used by other libraries, so it can arrive indirectly in your dependency tree.
How to check if you're exposed
Find every copy and its version:
npm ls seroval
pnpm why seroval
yarn why seroval
Then search your code, and the code of the packages that depend on it, for calls that deserialize JSON through seroval, since that is the affected path. If the data being deserialized can come from users or from other services you do not control, treat the exposure as real.
What to do now
- Upgrade seroval to 1.4.1 or later, directly or by updating the packages that depend on it.
- Add a resolution or override if a parent package pins an old version.
- Re-run
npm ls serovalto confirm no copy at or below 1.4.0 remains. - Validate and limit untrusted input before it reaches deserialization.
- Rebuild and redeploy.
Why it matters
The weakness is CWE-1321 (Prototype Pollution). In JavaScript, objects inherit from prototypes, and setting properties on a shared prototype changes the behavior of every object that inherits from it. If a deserializer lets an input key reach the prototype, the attacker can change defaults that the application relies on.
The effects depend on how the application reads properties afterwards. They can range from odd behavior and crashes to changes in authorization decisions, which is why the vector rates low impact on each of confidentiality, integrity and availability. Prototype pollution flaws recur in parsing and merging libraries, so dependency checks matter. The record does not mark this CVE as exploited in the wild.
Quick check
Does the flaw affect all seroval features?
The advisory says only JSON deserialization is affected.
Is there a workaround?
The advisory says there is no known workaround, so upgrade to 1.4.1 or later.
Sources
Last reviewed: 19 October 2026.
