CVE-2026-97711: Cross-Site Scripting (XSS) via Unescaped Script-Closing Tags in serialize-javascript

Vulnerability ID: CVE-2026-97711
CVSS Score: 2.3
Published: 2026-09-30

A security vulnerability in serialize-javascript v7.1.1 allows Cross-Site Scripting (XSS) due to an overly greedy regular expression (SCRIPT_CLOSE_REGEXP) used during function serialization. Two secondary defects involving a spoofed toString() validation bypass and a stateful native code validator are also addressed in the fixed version v7.1.2.

TL;DR

A failure to sanitize script-closing tags in serialize-javascript v7.1.1 allows unauthenticated Cross-Site Scripting (XSS) when serializing user-influenced function values embedded in HTML script elements.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-79
• Attack Vector: Network (AV:N)
• CVSS v4.0 Score: 2.3
• EPSS Score: N/A
• Impact: Cross-Site Scripting (XSS)
• Exploit Status: Proof-of-Concept
• CISA KEV Status: Not Listed

Affected Systems

• Node.js applications using serialize-javascript for server-side rendering state serialization.
• serialize-javascript: >= 7.1.0, <= 7.1.1 (Fixed in: 7.1.2)

Code Analysis

Commit: 2bdbaaf

prevent script close tag from being swallowed by a single match

Exploit Details

• GitHub Advisory: No description

Mitigation Strategies

• Upgrade serialize-javascript to version 7.1.2 or later.
• Avoid embedding serialized outputs directly into inline script blocks.
• Use HTML entity encoding on serialized outputs rendered in templates.

Remediation Steps:

1. Verify the current version of serialize-javascript in package-lock.json.
2. Run 'npm install [email protected]' or 'npm update serialize-javascript'.
3. Ensure any server-side rendered templates use safe hydration patterns like data attributes instead of inline executable script blocks.

References

• GitHub Security Advisory GHSA-gfhx-hw2g-v5hg
• Fix Commit 2bdbaaf
• Release v7.1.2
• NVD CVE-2026-97711 Detail
• CVE.org Record

Read the full report for CVE-2026-97711 on our website for more details including interactive diagrams and full exploit analysis.