in serialized function bodies"}},{"@type":"ListItem","position":4,"item":{"@type":"Thing","name":"CVE-2026-34043","url":"https://corgea.com/advisories/vulnerabilities/CVE-2026-34043","description":"Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects"}},{"@type":"ListItem","position":5,"item":{"@type":"Thing","name":"GHSA-5c6j-r48x-rmvq","url":"https://corgea.com/advisories/vulnerabilities/GHSA-5c6j-r48x-rmvq","description":"Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()"}},{"@type":"ListItem","position":6,"item":{"@type":"Thing","name":"CVE-2019-16769","url":"https://corgea.com/advisories/vulnerabilities/CVE-2019-16769","description":"Cross-Site Scripting in serialize-javascript"}},{"@type":"ListItem","position":7,"item":{"@type":"Thing","name":"CVE-2020-7660","url":"https://corgea.com/advisories/vulnerabilities/CVE-2020-7660","description":"Insecure serialization leading to RCE in serialize-javascript"}}]}
Start for Free
npm

serialize-javascript

View on npm registry
7 Total advisories
7 Vulnerabilities
0 Malware

Dependency scanning

Check whether serialize-javascript is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

Explore dependency scanning Explore AI SAST →

Vulnerabilities

UNKNOWN
npm

CVE-2026-115754

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
MEDIUM 5.4
npm

CVE-2024-11831

Cross-site Scripting (XSS) in serialize-javascript
UNKNOWN
npm

CVE-2026-97711

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
MEDIUM 5.9
npm

CVE-2026-34043

Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects
HIGH 8.1
npm

GHSA-5c6j-r48x-rmvq

Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()
MEDIUM 4.2
npm

CVE-2019-16769

Cross-Site Scripting in serialize-javascript
HIGH 8.1
npm

CVE-2020-7660

Insecure serialization leading to RCE in serialize-javascript

Browse more npm advisories

Learn What is SAST?

Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes