Seroval, a library used for JavaScript value stringification beyond JSON.stringify, has a flaw in versions 1.4.0 and earlier where overriding RegExp serialization with excessively large patterns can exhaust the JavaScript runtime's memory during deserialization. In addition, tailored RegExp patterns that trigger catastrophic backtracking can cause a Regular Expression Denial of Service, allowing an attacker to disrupt service by simply supplying crafted input that passes through the deserialization process.

The affected product is Seroval, developed by lxsmnsyc, available as an NPM package for Node.js. Vulnerable versions include 1.4.0 and earlier; any deployment relying on these versions is at risk, particularly those that deserialize user supplied or remote data using the library.

The CVSS score of 7.5 indicates a high severity impact, while the EPSS score of less than 1% suggests a low probability of exploitation at present. Nevertheless, the vulnerability can be triggered easily by providing a specially crafted string to any code that uses Seroval for deserialization, without the need for authentication. The lack of a CISA KEV listing means it has not yet been observed in the wild, but the combination of widespread use of the package and the severe denial of service potential warrants proactive attention.