Serialize an object including it's function into a JSON.
Switch branches/tags
Nothing to show
Latest commit f9051f4 Jun 4, 2017 @luin committed on GitHub Merge pull request #8 from luckyyang/patch-1


Serialize a object including it's function into a JSON.

Build Status


This module provides a way to unserialize strings into executable JavaScript code, so that it may lead security vulnerabilities if the original strings can be modified by untrusted third-parties (aka hackers). For instance, the following attack example provided by ajinabraham shows how to achieve arbitrary code injection with an IIFE:

var serialize = require('node-serialize');
var x = '{"rce":"_$$ND_FUNC$$_function (){console.log(\'exploited\')}()"}'

To avoid the security issues, at least one of the following methods should be taken:

  1. Make sure to send serialized strings internally, isolating them from potential hackers. For example, only sending the strings from backend to fronend and always using HTTPS instead of HTTP.

  2. Introduce public-key cryptosystems (e.g. RSA) to ensure the strings not being tampered with.


npm install node-serialize


var serialize = require('node-serialize');

Serialize an object including it's function:

var obj = {
  name: 'Bob',
  say: function() {
    return 'hi ' +;

var objS = serialize.serialize(obj);
typeof objS === 'string';
serialize.unserialize(objS).say() === 'hi Bob';

Serialize an object with a sub object:

var objWithSubObj = {
  obj: {
    name: 'Jeff',
    say: function() {
      return 'hi ' +;

var objWithSubObjS = serialize.serialize(objWithSubObj);
typeof objWithSubObjS === 'string';
serialize.unserialize(objWithSubObjS).obj.say() === 'hi Jeff';

Serialize a circular object:

var objCircular = {};
objCircular.self = objCircular;

var objCircularS = serialize.serialize(objCircular);
typeof objCircularS === 'string';
typeof serialize.unserialize(objCircularS).self.self.self.self === 'object';