p PatchFirst

PatchFirst · Vulnerabilidades recientes

Vulnerabilidades de serialize-javascript

Vulnerabilidades publicadas para serialize-javascript en los últimos 30 días: 2. Incluidas en el catálogo KEV: 0.

RSS ↗
Filtrar vulnerabilidades
Borrar filtros

Vulnerabilidades: 7

  1. CVE-2026-115897

    Baja · CVSS 2.1Corrección disponible

    Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

    Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This i

    serialize-javascriptNode.js
    • Actualiza a 7.1.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  2. CVE-2026-97711

    Baja · CVSS 2.3EPSS 0,3%Corrección disponible

    Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

    Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and opt

    serialize-javascriptNode.js
    • Actualiza a 7.1.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  3. CVE-2026-34043

    Media · CVSS 5.9EPSS 0,58%Corrección disponible

    Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

    Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

    serialize-javascriptNode.js
    • Actualiza a 7.0.5
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  4. GHSA-5c6j-r48x-rmvq

    Alta · CVSS 8.1Corrección disponible

    Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

    ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`. If an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `<script>` tags), the injected code executes. ```javascript const serialize = require('se

    serialize-javascriptNode.js
    • Actualiza a 7.0.3
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  5. CVE-2024-11831

    Media · CVSS 5.4EPSS 1,12%Corrección disponible

    Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

    A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

    serialize-javascriptNode.js
    • Actualiza a 6.0.2
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗Aviso original 3 ↗

  7. CVE-2019-16769

    Media · CVSS 4.2EPSS 0,8%Corrección disponible

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

    serialize-javascriptNode.js
    • Actualiza a 2.1.1
    Publicación Actualización
    Aviso original 1 ↗Aviso original 2 ↗

Comprueba tu servidor

Compara tu pila y las versiones instaladas con las bases actuales de vulnerabilidades.

Comprueba tu servidor →