CVE-2017-5941: node-serialize unserialize() deserialization leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication, full code execution impact, and very high EPSS probability make this an urgent fix despite the absence of KEV listing.

What it is

The node-serialize package 0.0.4 for Node.js deserializes untrusted data in its unserialize() function without validating embedded functions. An attacker can supply a serialized JavaScript object containing an Immediately Invoked Function Expression (IIFE) that executes when deserialized. This is a critical remote code execution flaw in a widely used serialization library.

Impact

An attacker gains arbitrary code execution in the Node.js process, allowing full compromise of the application and any data or credentials it can reach. With network reachability and no privileges required, this can lead to complete loss of confidentiality, integrity and availability.

Attack surface

Reached over the network wherever application code passes untrusted input (request bodies, cookies, query parameters, message payloads) into node-serialize's unserialize(). No authentication or user interaction is required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit write-ups and Packet Storm entries exist, and EPSS is 0.61 (99th percentile), indicating high likelihood of exploitation activity. It is not listed in CISA KEV, so no confirmed in-the-wild federal exploitation record is present.

What to do

• Upgrade or remove node-serialize 0.0.4; the package is unmaintained, so migrate to a safe serialization format such as JSON with schema validation.
• Never pass untrusted input to unserialize(); treat all deserialized data as hostile and validate against a strict allowlist.
• If the library cannot be removed immediately, block or sanitize payloads containing function syntax or IIFE patterns before deserialization.
• Restrict network exposure of Node.js services that use the library and apply least-privilege runtime permissions to limit post-exploitation impact.

Detection

• Search code and dependency manifests for node-serialize 0.0.4 and any call to unserialize() on request-derived data.
• Monitor Node.js process behavior for unexpected child_process, eval, or Function execution following HTTP requests.
• Alert on request payloads containing IIFE or function-expression patterns reaching deserialization endpoints.
• Review outbound network connections and file writes from Node.js services for signs of post-exploitation activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.