Cross-Site Scripting Vulnerability in node-serialize-javascript Package
Summary
DEBIAN-CVE-2026-97711: Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functions. Affects node-serialize-javascript versions 6.0.0-2 – 7.1.2+~5.0.4-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The node-serialize-javascript package is a JavaScript library that serializes JavaScript values into a superset of JSON, which includes support for regular expressions and functions. This package is widely used in various applications to safely serialize data for storage or transmission. However, it has been identified that versions 7.1.1 to 7.1.2 are vulnerable to a cross-site scripting (XSS) attack due to improper handling of function values.
Vulnerability Detail
The vulnerability arises from the way function values are serialized by the node-serialize-javascript package. Specifically, the SCRIPT_CLOSE_REGEXP can incorrectly match multiple closing script tags within a single function source. This flaw allows an attacker to inject malicious scripts that can terminate the script element prematurely, leading to XSS attacks. The issue is limited to function values, while ordinary data values and options.isJSON outputs remain unaffected.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the package, consider avoiding the use of function values in your serialization processes. Instead, use ordinary data values or ensure that any function values are sanitized to prevent the inclusion of script-closing tags.
Conclusion
The node-serialize-javascript package has a critical vulnerability that can lead to cross-site scripting attacks if not addressed. It is essential to update to the patched version 7.1.2 or later to mitigate this risk. Additionally, users should consider using Vulert to monitor their applications for vulnerabilities effectively.
See every vulnerability recorded for node-serialize-javascript →
FAQ
The vulnerability allows for cross-site scripting (XSS) attacks due to improper handling of function values in the serialization process.
Versions 7.1.1 to 7.1.2 of the node-serialize-javascript package are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
As a temporary measure, avoid using function values in serialization or ensure that they are sanitized to prevent script injection.
Vulert is a tool that monitors and alerts for open-source vulnerabilities in your software using just a manifest file like package-lock.json. It helps you stay informed about potential security risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-serialize-javascript.
