# CVE-2019-16769: serialize-javascript Cross-Site Scripting in regular expressions

Source: https://junglewise.ai/threats/cve-2019-16769-serialize-javascript-cross-site-scripting-in-regular-expressions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2019-12-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2019-16769 · Severity: low · CVSS 3.1 · Published 2019-12-05

serialize-javascript is a popular JavaScript library used to convert objects into serialized strings for data transmission and storage. Versions prior to 2.1.1 fail to properly escape special characters in serialized regular expressions, allowing attackers to inject malicious scripts. This issue primarily affects web applications that use this library to serialize data and render it in browsers outside of Node.js environments.

Technologies: [serialize-javascript (npm)](https://junglewise.ai/threats/technologies/serialize-javascript). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2019-16769 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-16769 being exploited in the wild.

**How severe is CVE-2019-16769?** Low severity, with a CVSS score of 3.1, published 5 December 2019.

**Which products and versions are affected?** serialize-javascript (npm) SEMVER:introduced=0,fixed=2.1.1.

**Is there a fix for CVE-2019-16769?** Yes. serialize-javascript (npm): upgrade to 2.1.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2019-16769 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2019-16769?** Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- serialize-javascript (npm): upgrade to 2.1.1 or later

  ```sh
  npm install serialize-javascript@2.1.1
  ```


## Technical details

This is a Cross-Site Scripting (CWE-79) vulnerability in the serialize-javascript npm package prior to version 2.1.1. The vulnerability exists because the library does not properly sanitize or escape unsafe characters when serializing JavaScript regular expression objects. When serialized regex patterns are deserialized and rendered in a browser context (the vulnerability does not affect Node.js), an attacker can craft a malicious regular expression that injects arbitrary JavaScript code. The attack requires the attacker to control the input data being serialized or to exploit a scenario where user-controlled data is reflected. Patches are available in version 2.1.1 and later.

## Affected products

- Yahoo serialize-javascript prior to 2.1.1

## Identifiers

- CVE-2019-16769
- GHSA-h9rv-jmmf-4pgx

## Timeline

- 2019-12-05: disclosed
- 2019-12-05: patched: Version 2.1.1 released

## References

- [https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx](https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx)

## Related threats

- [Yahoo Serialize JavaScript XSS via unescaped script tag in function body](https://junglewise.ai/threats/cve-2026-115897-serialize-javascript-serializes-javascript-values-to-a-superset)
- [serialize-javascript cross-site scripting via unescaped script tag](https://junglewise.ai/threats/cve-2026-115754-serialize-javascript-from-7-0-1-before-7-1-3-contains-a-cross)
- [serialize-javascript XSS via script-closing tag bypass in functions](https://junglewise.ai/threats/cve-2026-97711-serialize-javascript-serializes-javascript-values-to-a-superset)
- [Yahoo serialize-javascript CPU exhaustion DoS via crafted array-like objects](https://junglewise.ai/threats/cve-2026-34043-yahoo-serialize-javascript-cpu-exhaustion-dos-via-crafted-array)
- [serialize-javascript code injection via RegExp.flags and Date.toISOString](https://junglewise.ai/threats/serialize-javascript-code-injection-via-regexp-flags-and-date-a4d4abae)