Deserialization attack prevention

Unsafe deserialization (CWE-502, OWASP A08 Software and Data Integrity Failures) enables remote code execution when attacker-controlled serialized objects are reconstructed by a library that executes code during deserialization. The node-serialize library is the canonical Node.js example: it evaluates immediately-invoked function expressions (IIFEs) embedded in the serialized payload. NIST 800-53 SI-10 requires validation of all input before processing. Unlike JSON.parse (which only creates primitive values and plain objects), unsafe deserialization libraries can reconstruct class instances, triggering constructor side effects defined by the attacker.

Replace unsafe deserialization libraries with JSON.parse followed by Zod schema validation. Never call node-serialize.unserialize() on untrusted input:

import { z } from 'zod'

// Unsafe — executes IIFEs in the payload:
// const data = require('node-serialize').unserialize(userInput)

// Safe — only parses JSON primitives, then validates shape:
const DataSchema = z.object({
  type: z.enum(['config', 'preferences']),
  value: z.number().int().nonnegative(),
})

const parsed = JSON.parse(userInput)  // No code execution
const data = DataSchema.parse(parsed) // Throws on invalid shape

Audit package.json for node-serialize, serialize-javascript (when used to deserialize), or qs with allowPrototypes: true — these are the most commonly exploited deserialization vectors in Node.js.