Denial of Service in serialize-to-js

Description

Versions of serialize-to-js prior to 2.0.0 are vulnerable to Denial of Service. User input is not properly validated, allowing attackers to provide inputs that lead the execution to loop indefinitely.

Recommendation

Update the serialize-to-js package to the latest compatible version. Followings are version details:

• Affected version(s): < 2.0.0
• Patched version(s): 2.0.0

References

• GHSA-w5q7-3pr9-x44w
• www.npmjs.com

Related Issues

• Regular Expression Denial of Service in underscore.string - Vulnerability
• tarteaucitron.js has Regular Expression Denial of Service (ReDoS) vulnerability - CVE-2026-22809
• Denial of Service in url-relative - Vulnerability
• Regular Expression Denial of Service in millisecond - Vulnerability

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

serialize-to-js