Skip to content

Conversation

@aikido-autofix
Copy link
Contributor

Upgrade seroval and @tanstack/react-router-devtools to address critical RCE, prototype pollution, and DoS vulnerabilities in JSON deserialization.

✅ 4 CVEs resolved by this upgrade

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-23957
HIGH
A deserialization vulnerability allows attackers to manipulate array length encoding, potentially causing excessive processing time and a denial of service (DoS) condition during data deserialization.
CVE-2026-23737
HIGH
Improper JSON deserialization allows remote code execution by manipulating constant values and error handling, requiring multiple requests and partial context knowledge to exploit unsafe JavaScript evaluation.
CVE-2026-23736
HIGH
Due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization.
This affects only JSON deserialization functionality.

As there is no known workaround, please upgrade to the latest version.
CVE-2026-23956
LOW
A RegExp serialization vulnerability allows memory exhaustion and ReDoS attacks by crafting malicious regex patterns during deserialization, potentially causing runtime crashes or resource consumption.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant