CVE-2026-97711: serialize-javascript Cross-Site Scripting (XSS) Vulnerability in Function Serialization
Summary
CVE-2026-97711: Serialize JavaScript: Cross-site scripting (XSS) via unescaped in serialized function bodies. Affects serialize-javascript versions >= 7.1.1, < 7.1.2. Fixed in 7.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
serialize-javascript is a popular npm package used to serialize JavaScript objects into a format that can be safely embedded in HTML. It ensures that the serialized output is safe for inclusion within <script> tags. However, a vulnerability was discovered in version 7.1.1 that compromises this safety for function values, allowing potential XSS attacks.
Vulnerability Detail
The vulnerability arises from the way serialize-javascript handles function values. In version 7.1.1, it fails to properly escape certain characters, specifically allowing a crafted function body to include an unescaped </script> tag. This can lead to early termination of the <script> element, causing subsequent HTML to be parsed and executed, which may include malicious scripts. The issue is rooted in the regular expression used to identify script closing tags, which inadequately excludes the '<' character, allowing for exploitation.
How To Fix
Latest published version: 7.1.3 as of 22 Oct 2026
npm install serialize-javascript@7.1.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.1.2
This is the first release that contains the fix.
npm install serialize-javascript@7.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot upgrade to version 7.1.2, consider avoiding the serialization of functions that may contain attacker-influenced source text. Alternatively, you can use version 7.1.0 or earlier, which is unaffected by this issue.
Conclusion
The CVE-2026-97711 vulnerability in serialize-javascript poses a significant risk due to its potential for XSS attacks through improperly serialized function values. Users are strongly advised to upgrade to version 7.1.2 or later to mitigate this risk. For those unable to upgrade, alternative strategies should be employed to avoid serialization of unsafe content.
See every vulnerability recorded for serialize-javascript →
FAQ
The vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to data theft, session hijacking, or other malicious actions.
It occurs due to improper escaping of the </script> tag in serialized function bodies, allowing for XSS attacks.
Versions 7.1.1 is affected. Versions 7.1.2 and later contain the necessary fixes.
If upgrading is not an option, avoid serializing functions with potentially unsafe content or use version 7.1.0 or earlier.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software by analyzing your package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for serialize-javascript.
