CVE-2017-15871: High severity serialize-javascript vulnerability
DISPUTED The deserialize function in serialize-to-js through 1.1.1 allows attackers to cause a denial of service via vectors involving an Immediately Invoked Function Expression "function()" substring, as demonstrated by a "function(){console.log(" call or a simple infinite loop. NOTE: the vendor agrees that denial of service can occur but notes that deserialize is explicitly listed as "harmful" within the README.md file.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15871?
CVE-2017-15871 is considered a medium severity vulnerability due to its potential for denial of service.
How do I fix CVE-2017-15871?
To fix CVE-2017-15871, upgrade the serialize-to-js package to version 1.1.2 or later.
What type of attack does CVE-2017-15871 allow?
CVE-2017-15871 allows attackers to exploit a denial of service via specific input causing infinite loops or other resource-intensive operations.
Which versions of serialize-to-js are affected by CVE-2017-15871?
CVE-2017-15871 affects all versions of serialize-to-js up to and including 1.1.1.
Is CVE-2017-15871 a critical vulnerability?
CVE-2017-15871 is not classified as critical; its impact is largely denial of service rather than data exposure.