The flaw arises because seroval does not validate object keys during JSON deserialization. An attacker can supply a key that targets internal prototype properties, such as __proto__ or constructor, causing those properties to be overwritten on the Object prototype. This prototype pollution can alter the behavior of any subsequent code that runs in the same JavaScript process.

The vulnerable versions of lxsmnsyc's seroval library (1.4.0 and earlier) are used in Node.js applications. All installations of seroval up to 1.4.0 are affected, while releases starting with 1.4.1 contain the patch.

The CVSS score is 7.3, indicating a high impact, and the EPSS score is below 1%, suggesting that exploitation attempts are currently rare. The vulnerability is not listed in CISA's KEV catalog. Attackers can trigger the flaw by supplying crafted JSON to any code path that invokes seroval's deserialize function; privileged input is not required.