Seroval, a library that stringifies JavaScript values beyond JSON.stringify capabilities, has a flaw that affects versions 0.2.0 through 1.4.0. The vulnerability is an instance of CWE-1333, runtime memory exhaustion caused by catastrophically large or backtracking‑heavy regular expressions. An attacker can override RegExp serialization with an extremely large pattern or a pattern designed for catastrophic backtracking, causing the JavaScript runtime to exhaust memory during deserialization and resulting in a denial of service. These flaws can be triggered simply by supplying crafted input to the deserialization process, without authentication, and were fixed in version 1.4.1.

The library Seroval is published by lxsmnsyc as an NPM package for Node.js. Vulnerable releases span 0.2.0 to 1.4.0. Any installations using those versions that perform deserialization of external or user‑supplied data are at risk.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Nevertheless, the vulnerability can be triggered easily by providing a specially crafted string to any code that uses Seroval for deserialization, without the need for authentication. The lack of a CISA KEV listing means it has not yet been observed in the wild, but the combination of widespread use of the package and the severe denial of service potential warrants proactive attention.