PatchTheCVEserialize-to-js vulnerabilities and fixes
Recent CVEs affecting serialize-to-js, with upgrade or downgrade steps. 2 tracked.
Also searched as: serialize to js.
serialize-to-js has 2 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 2. Most recent: 2019-12-07. Highest priority: CVE-2017-15871 (score 53/100).
- CVE-2019-16772 LOW 3.1 UPGRADE The serialize-to-js NPM package before version 3.0.1 is vulnerable to Cross-site Scripting (XSS)
- CVE-2017-15871 HIGH 7.5 UPGRADE The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via ve
FAQ
How do I fix serialize-to-js vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is serialize-to-js being exploited right now?
None of the tracked serialize-to-js CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which serialize-to-js CVE should I patch first?
CVE-2017-15871 currently ranks highest (53/100): The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via ve.