Denial of Service in serialize-to-js

Description

Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.

Recommendation

Update the serialize-to-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-w5q7-3pr9-x44w
• www.npmjs.com

Related Issues

• Regular Expression Denial of Service in markdown - Vulnerability
• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
• prismjs Regular Expression Denial of Service vulnerability - CVE-2021-3801
• ua-parser-js Regular Expression Denial of Service vulnerability - CVE-2020-7793

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

serialize-to-js