CVE-2026-97711: Serialize JavaScript XSS Vulnerability

CVE-2026-97711 Overview

CVE-2026-97711 affects the serialize-javascript npm package, a library that serializes JavaScript values to a superset of JSON including regular expressions and functions. The flaw exists in versions 7.1.1 through 7.1.1 and was fixed in version 7.1.2. The SCRIPT_CLOSE_REGEXP used to neutralize </script> tags inside serialized function source can consume a second closing tag inside one match. Attacker-influenced function source embedded in a <script> element can terminate the element early, causing the remainder of the output to be parsed as HTML. This enables cross-site scripting (XSS) in the page origin [CWE-79]. Only function values are affected; ordinary data values and options.isJSON output remain unaffected.

Critical Impact
Attacker-influenced function source serialized into a <script> element can break out of the script context and execute arbitrary JavaScript in the page origin.

Affected Products

serialize-javascript version 7.1.1
Applications embedding serialized function values into inline <script> elements
Server-side rendering frameworks that depend on serialize-javascript for state hydration

Discovery Timeline

2026-09-29 - CVE-2026-97711 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-97711

Vulnerability Analysis

The vulnerability is a cross-site scripting flaw in the escaping logic for serialized function values. The SCRIPT_CLOSE_REGEXP regular expression was intended to neutralize any </script> sequences appearing inside a serialized function body. Because the regex could match a full </script...> tag followed by additional characters in a single greedy match, a second </script prefix positioned inside the same match window was not neutralized. When the resulting serialized output is embedded in an inline <script> element, the surviving closing tag terminates the script early. The remainder of the serialized payload is then parsed as HTML, allowing an attacker who controls part of a function's source to inject arbitrary markup and JavaScript.

Root Cause

The root cause is an incorrect regular expression used for HTML-context escaping. SCRIPT_CLOSE_REGEXP was defined as /<\/script[^>]*>|<\/script(?=[\t\n\f\r \/>])/gi. The first alternative consumed everything up to and including the > of a script end tag, which could span across a second </script prefix positioned before the closing >. The patch narrows the regex so only characters that the HTML tokenizer treats as ending the tag name are matched, preventing the greedy consumption behavior. A related change also converts IS_NATIVE_CODE_REGEXP from a global regex to a non-global one, because .test() on a /g regexp advances lastIndex and could mis-classify a native function on a second call.

Attack Vector

Exploitation requires an application to serialize a function whose source contains attacker-controlled substrings and then embed the result inside an inline <script> element. User interaction is required to load or view the affected page. The impact is limited to the browser origin serving the vulnerable page.

javascript

 var UID                 = generateUID();
 var PLACE_HOLDER_REGEXP = new RegExp('(\\\\)?"@__(F|R|D|M|S|A|U|I|B|L)-' + UID + '-(\\d+)__@"', 'g');
 
-var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/g;
+// Not global: `.test()` on a `/g` regexp advances `lastIndex`, so a second
+// call could start past a `[native code]` match and wrongly report a native
+// function as safe to serialize.
+var IS_NATIVE_CODE_REGEXP = /\{\s*\[native code\]\s*\}/;
 var IS_PURE_FUNCTION = /function.*?\(/;
 var IS_ARROW_FUNCTION = /.*?=>.*?/;
 var UNSAFE_CHARS_REGEXP   = /[<>\/\\u2028\\u2029]/g;
-var SCRIPT_CLOSE_REGEXP = /<\/script[^>]*>|<\/script(?=[\t\n\f\r \/>])/gi;
+// literal `</script>`, or a bare `</script` followed by one of the other
+// characters (TAB, LF, FF, CR, SPACE, `/`) that the HTML tokenizer treats as
+// ending the tag name.

Source: GitHub commit 2bdbaaf

Detection Methods for CVE-2026-97711

Indicators of Compromise

Unexpected </script> sequences appearing inside serialized function bodies in server-rendered HTML responses.
Content Security Policy (CSP) violation reports referencing inline script execution on pages that hydrate serialized state.
Client-side JavaScript errors immediately preceding injected markup in rendered HTML.

Detection Strategies

Inventory application dependencies to identify use of serialize-javascript at version 7.1.1.
Perform source code review of call sites that pass function values into serialize-javascript with untrusted input in scope.
Fuzz serialized outputs with payloads containing repeated </script prefixes to confirm escape behavior.

Monitoring Recommendations

Enable CSP with report-uri or report-to directives to capture inline execution attempts.
Log and alert on outbound HTML responses that contain unescaped </script> sequences within serialization placeholders.
Track npm audit and Software Bill of Materials (SBOM) reports for pinned versions of serialize-javascript.

How to Mitigate CVE-2026-97711

Immediate Actions Required

Upgrade serialize-javascript to version 7.1.2 or later across all application dependencies and transitive dependencies.
Audit code paths that serialize function values derived from user input and remove serialization of untrusted functions where possible.
Regenerate and redeploy any server-rendered bundles that were built against the vulnerable version.

Patch Information

The fix is available in serialize-javascript version 7.1.2. Review the GitHub Security Advisory GHSA-gfhx-hw2g-v5hg, the v7.1.2 release notes, and the patch commit for details on the regex correction.

Workarounds

Avoid passing function values that contain attacker-influenced strings to serialize-javascript; use options.isJSON where only data serialization is required.
Emit serialized output into a <script type="application/json"> block and parse it at runtime instead of inline evaluation.
Deploy a strict Content Security Policy that disallows inline script execution to reduce the impact of any bypass.

bash

# Configuration example
npm install serialize-javascript@7.1.2
npm ls serialize-javascript