TL;DR
Insecure deserialization happens when an app rebuilds objects from data an attacker controls, and the rebuilding itself runs code. It's mostly a Java, PHP and Python problem, because those languages serialize objects natively. If your app passes JSON around, you're probably fine. Validate the shape and types anyway, for reasons that have nothing to do with code execution.
What Is Insecure Deserialization?
Serialization turns an object into something you can store or send. Deserialization turns it back. The danger is in that second step: if the format can describe which class to build and what to run while building it, then whoever controls the data controls your process. Feed an app untrusted serialized data and an attacker may be able to:
- Execute arbitrary code
- Manipulate application logic
- Bypass authentication
- Access sensitive data
Is My JavaScript App at Risk?
Good news: JavaScript's JSON.parse() doesn't execute code during parsing. Most modern JavaScript apps that use JSON for data exchange aren't vulnerable to classic deserialization attacks.
You're exposed, though, if any of these apply:
- Use
eval()ornew Function()with user data - Use libraries with custom object serialization
- Trust serialized objects in cookies or tokens without validation
- Have a Node.js backend using libraries like
node-serialize
JavaScript-Specific Risks
Dangerous: Using eval() with User Data
// EXTREMELY DANGEROUS
const userData = req.body.data;
const result = eval(userData); // Remote code execution!
// Also dangerous
const fn = new Function('return ' + userData);
fn();
Safer: JSON with Validation
import { z } from 'zod';
const UserSchema = z.object({
id: z.string().uuid(),
name: z.string().max(100),
email: z.string().email(),
role: z.enum(['user', 'admin'])
});
// Parse and validate in one step
const user = UserSchema.parse(JSON.parse(requestBody));
// If validation fails, it throws an error
Where It Matters More
The classic attacks all live elsewhere. Three ecosystems carry most of them:
- Java applications: Java's ObjectInputStream can execute code during deserialization
- PHP applications: PHP's unserialize() has led to many RCE vulnerabilities
- Python applications: pickle module can execute arbitrary code
Is JSON.parse() safe?
JSON.parse() is safe from code execution. It only creates data structures (objects, arrays, strings, numbers, booleans, null). It doesn't execute functions or create class instances.
What about JWT tokens?
Parsing a JWT is safe. Trusting it isn't. The payload is base64, not encryption, so anyone can read and rewrite it: verify the signature with your secret before you believe a single field in there.
Should I still validate JSON data?
Yes, just for different reasons. JSON.parse() won't run anything, but it'll happily hand you an object with missing fields or a string where you expected a number. That's a logic bug, not an RCE, and it still breaks things.
Scan for Security Issues
Our scanner checks for dangerous patterns in your code.