CVE-2017-5954: An issue was discovered in the serialize-to-js package 0.5.0 for Node.js.

Security readout for executives and security teams

This CVE concerns a Node.js serialization library that can execute attacker-controlled JavaScript when untrusted data is deserialized. If an exposed application feeds user-controlled input into serialize-to-js deserialize(), compromise could extend to the application process and its data. Exposure is most likely in Node.js applications that depend on serialize-to-js 0.5.0 and deserialize data from users, APIs, queues, cookies, sessions, or stored records that attackers can influence. Prioritize review where this library is present in internet-facing or partner-facing Node.js services. The business risk is application takeover, but urgency depends on whether untrusted input reaches deserialize(). Mitigation focus: Do not pass untrusted or externally influenced data into deserialize().; Inventory and remove serialize-to-js 0.5.0 where it is not strictly required.; Disable exposed features that deserialize external input until risk is resolved..

Prepared

Jun 13, 2026, 06:20 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.