Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 28 February 2026.

Which products and versions are affected?

serialize-javascript (npm) SEMVER:introduced=0,fixed=7.0.3.

Is there a fix for This vulnerability?

Yes. serialize-javascript (npm): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

serialize-javascript code injection via RegExp.flags and Date.toISOString

Severity: low · CVSS 3.1 · Published 2026-02-28

The serialize-javascript npm package converts JavaScript objects into serialized strings for storage or transmission. An attacker who controls the input to this library can inject malicious code through RegExp flags or Date methods that gets executed when the serialized output is evaluated (via eval or new Function). This is an incomplete fix for a previous vulnerability and allows remote code execution in server environments that deserialize untrusted data.

Technologies: serialize-javascript (npm). Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 28 February 2026.
Which products and versions are affected?: serialize-javascript (npm) SEMVER:introduced=0,fixed=7.0.3.
Is there a fix for This vulnerability?: Yes. serialize-javascript (npm): upgrade to 7.0.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run serialize-javascript (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

serialize-javascript (npm): upgrade to 7.0.3 or later
```
npm install serialize-javascript@7.0.3
```

Technical details

The vulnerability is a static code injection (CWE-96) affecting the serialize-javascript library's handling of RegExp and Date objects. When serializing a RegExp, the library properly escapes the source property but fails to escape the flags property, allowing an attacker to craft a fake RegExp object (via Object.create and property descriptors) that injects arbitrary code into the generated output string. Similarly, Date.prototype.toISOString() is called without sanitization, enabling injection through fake Date objects. The attack requires the attacker to control the input object passed to serialize(), and the injected code executes when the output is evaluated via eval(), new Function(), or script tags. This is particularly dangerous in Node.js environments where eval'd code has access to require() and can execute arbitrary system commands. The fix is available in version 7.0.3 and properly escapes both the flags property and Date serialization.

Affected products

Yahoo serialize-javascript ≤ 7.0.2

Timeline

2026-02-28: disclosed
2026-02-27: patched: Fix released in version 7.0.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.