Route parameters are serialized safely and not vulnerable to injection

Route parameters that carry non-serializable values — functions, class instances, Date objects, circular references — silently corrupt navigation state when React Navigation serializes the stack for deep linking, state persistence, or web URL synchronization. On top of serialization breakage, passing unsanitized user input directly as route parameters (from a text input or deep link) is an OWASP A03 / CWE-20 injection surface: a crafted parameter value can overwrite screen state or trigger unexpected navigation behavior. The Mobile Offline & Storage audit (mobile-offline-storage) documents the parallel risk in storage serialization — the same class of defect.

Pass only JSON-primitive values in navigation.navigate() — IDs, strings, booleans — and fetch or reconstruct complex objects in the destination screen.

// Correct: pass the ID, fetch the object in the destination
navigation.navigate('ProductDetail', { productId: '123' })

// Wrong: passing the object directly (breaks serialization)
// navigation.navigate('ProductDetail', { product: fullProductObject })

// In the destination screen, validate before use
function ProductDetailScreen() {
  const { productId } = useRoute().params

  useEffect(() => {
    if (typeof productId !== 'string' || !/^\d+$/.test(productId)) return
    fetchProduct(productId).then(setProduct)
  }, [productId])
}

For user-sourced string params (search queries, names entered in forms), sanitize by stripping or encoding control characters before passing to navigate(). Never pass the raw output of a text input as a route param without at least a trim() and type assertion.