PkgSeer

Vulnerability GHSA-hx9m-jf43-8ffr

High Risk

8 months ago

seroval affected by Denial of Service via RegExp serialization

0.2.0 - 1.4.0

Summary

seroval affected by Denial of Service via RegExp serialization

Details

Overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service).

Mitigation:
Seroval introduces disabledFeatures (a bitmask) in serialization/deserialization methods, with Feature.RegExp as a dedicated flag. Users are recommended to configure disabledFeatures to disable RegExp serialization entirely.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of GHSA-mv8w-475r-vwqw)

0.12.0 - 1.6.1 GHSA-p6vx-979v-rg4c

Seroval: Memory exhaustion via unchecked TypedArray length in JSON deserialization

0.1.0 - 1.6.2 GHSA-jp82-f5mq-hwhp

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

0.1.0 - 1.5.2 GHSA-mv8w-475r-vwqw

Seroval affected by Denial of Service via Deeply Nested Objects

0.1.0 - 1.4.0 GHSA-3j22-8qj3-26mx

Seroval affected by Denial of Service via Array serialization

0.1.0 - 1.4.0 GHSA-66fc-rw6m-c2q6

View all vulnerabilities for these packages

Impacted packages

seroval

Timeline

Published

8 months ago

Fixed (1.4.1)

9 months ago

Last Modified

4 months ago