CVE catalog

CVE-2024-11831

node-serialize-javascript: CVE-2024-11831

[CVE catalog]

Severity
Medium · CVSS 5.4CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.12% · Oct 25, 2026

A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-serialize-javascriptsid7.1.4+~5.0.4-1fixed
Debiannode-serialize-javascriptforky7.1.4+~5.0.4-1fixed
Debiannode-serialize-javascripttrixie6.0.2-1fixed
Debiannode-serialize-javascriptbookworm6.0.0-2+deb12u1fixed
Npmserialize-javascriptNot reported6.0.2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-serialize-javascriptsourcesid6.0.2-1not yet assignedNot reported[1095767]
Debiannode-serialize-javascriptsourceforky6.0.2-1not yet assignedNot reported[1095767]
Debiannode-serialize-javascriptsourcetrixie6.0.2-1not yet assignedNot reported[1095767]
Debiannode-serialize-javascriptsourcebookworm6.0.0-2+deb12u1not yet assignedNot reported[1095767]
Npmserialize-javascriptnpmNot reported6.0.2Not reportedGHSA-76P7-773F-R4Q5Not reported

[Debian bug #1095767]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-serialize-javascript]Fixed
    Details (2)

    • 6.0.0-2+deb12u1 · all · bookworm

      Fixed · Fixed: 6.0.0-2+deb12u1

      dsa · node-serialize-javascript · debian · bookworm; dsa · node-serialize-javascript · debian · 12

    • 6.0.0-2+deb12u1 · all · bookworm

      Fixed · Fixed: 6.0.0-2+deb12u1

      dsa · node-serialize-javascript · debian · bookworm; dsa · node-serialize-javascript · debian · 12

[Debian 13 (Trixie)]

  • [node-serialize-javascript]Fixed
    Details (2)

    • 6.0.2-1 · all · trixie

      Fixed · Fixed: 6.0.2-1

      dsa · node-serialize-javascript · debian · 13

    • 6.0.2-1 · all · trixie

      Fixed · Fixed: 6.0.2-1

      dsa · node-serialize-javascript · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]