Zennoxa Shield
Rules / JavaScript / TypeScript
SHIELD-JS-018

Insecure deserialization (node-serialize)

criticalJavaScript / TypeScriptCWE-502CVSS 9.8

What it detects

node-serialize's unserialize() executes embedded function bodies (`$$ND_FUNC$$`) — deserializing untrusted input is remote code execution.

How to fix

Never unserialize untrusted data. Use JSON.parse for data; if you need typed objects, validate against a schema.

Vulnerable — Shield flags thisapp.js
const serialize = require('node-serialize');
const express = require('express');
const app = express();

app.post('/load', (req, res) => {
  const payload = req.body.state;
  const obj = serialize.unserialize(payload);
  res.json(obj);
});

module.exports = app;
Fixed — scans cleanapp.js
const express = require('express');
const app = express();

app.post('/load', (req, res) => {
  const payload = req.body.state;
  const obj = JSON.parse(payload);
  res.json(obj);
});

module.exports = app;

Both snippets are verified against the shipped scanner: the vulnerable one triggers SHIELD-JS-018, the fixed one does not.

Scan your repo freeFull documentation
Back to all rules
SHIELD-JS-018: Insecure deserialization (node-serialize) — Zennoxa Shield