Executive brief
serialize-to-js is a JavaScript utility library for converting objects into serialized strings. The library is vulnerable to denial of service attacks where maliciously crafted input can cause the application to hang indefinitely, disrupting service availability for all users.
Technical details
serialize-to-js prior to version 2.0.0 contains a denial of service vulnerability stemming from improper input validation. Attackers can craft specific inputs that trigger infinite loops during the serialization process, causing the application to hang. The vulnerability affects all versions prior to the fix in version 2.0.0. No special authentication or complex preconditions are required—any user able to provide input to the serialize function can trigger the DoS condition.
Affected products
- serialize-to-js serialize-to-js prior to 2.0.0
Timeline
- 2020-09-02: disclosed
- 2020-09-02: patched: Fixed in version 2.0.0