p PatchFirst

PatchFirst · Vulnérabilités récentes

Vulnérabilités de serialize-javascript

Vulnérabilités publiées pour serialize-javascript au cours des 30 derniers jours : 2. Présentes dans le catalogue KEV : 0.

RSS ↗
Filtrer les vulnérabilités
Effacer les filtres

Vulnérabilités : 7

  1. CVE-2026-115897

    Faible · CVSS 2.1Correctif disponible

    Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body

    Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Prior to 7.1.3, the function-source escaping logic does not neutralize a bare closing-script prefix when attacker-influenced function source text ends exactly at that prefix. Because each function body is escaped independently, a delimiter supplied by surrounding serialized output can terminate an HTML script element, and a later serialized value supplies injected markup that becomes a live element in the page. Exploitation requires control of a serialized function's source text, such as through a spoofed toString(). This i

    serialize-javascriptNode.js
    • Mettez à jour vers 7.1.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  2. CVE-2026-97711

    Faible · CVSS 2.3EPSS 0,3%Correctif disponible

    Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies

    Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. From 7.1.1 until 7.1.2, function values serialized by serialize-javascript are not fully protected against script-closing tags in attacker-influenced function source because SCRIPT_CLOSE_REGEXP can consume a second closing tag inside one match. When the serialized function is embedded in a script element, the surviving closing tag terminates the element early and causes the remaining output to be parsed as HTML, enabling cross-site scripting in the page origin. Only function values are affected; ordinary data values and opt

    serialize-javascriptNode.js
    • Mettez à jour vers 7.1.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  3. CVE-2026-34043

    Moyenne · CVSS 5.9EPSS 0,58%Correctif disponible

    Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects

    Serialize JavaScript to a superset of JSON that includes regular expressions and functions. Prior to version 7.0.5, there is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely. This issue has been patched in version 7.0.5.

    serialize-javascriptNode.js
    • Mettez à jour vers 7.0.5
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  4. GHSA-5c6j-r48x-rmvq

    Élevée · CVSS 8.1Correctif disponible

    Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()

    ### Impact The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660. While `RegExp.source` is sanitized, `RegExp.flags` is interpolated directly into the generated output without escaping. A similar issue exists in `Date.prototype.toISOString()`. If an attacker can control the input object passed to `serialize()`, they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via `eval`, `new Function`, or `<script>` tags), the injected code executes. ```javascript const serialize = require('se

    serialize-javascriptNode.js
    • Mettez à jour vers 7.0.3
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  5. CVE-2024-11831

    Moyenne · CVSS 5.4EPSS 1,12%Correctif disponible

    Npm-serialize-javascript: cross-site scripting (xss) in serialize-javascript

    A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

    serialize-javascriptNode.js
    • Mettez à jour vers 6.0.2
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗Avis original 3 ↗

  7. CVE-2019-16769

    Moyenne · CVSS 4.2EPSS 0,8%Correctif disponible

    Affected versions of serialize-javascript are vulnerable to Cross-site Scripting (XSS)

    The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

    serialize-javascriptNode.js
    • Mettez à jour vers 2.1.1
    Publication Mise à jour
    Avis original 1 ↗Avis original 2 ↗

Vérifiez votre serveur

Comparez votre pile et les versions installées aux bases de vulnérabilités actuelles.

Vérifiez votre serveur →