Insecure deserialization (ARCH3109)

Key typescript.security.insecure-deserialization · Severity critical · Category security · CWE CWE-502

Deserializing untrusted data with a gadget-capable deserializer is a classic remote-code-execution vector. Use only a safe, data-only format (JSON) for untrusted input.

Incorrect

import { unserialize } from "node-serialize";

app.post("/restore", (req, res) => {
  const state = unserialize(req.body.payload);
  res.json(state);
});

Correct

app.post("/restore", (req, res) => {
  const state = JSON.parse(req.body.payload);
  res.json(state);
});

Fix

Avoid deserializers that revive functions/objects on untrusted data; use plain JSON.parse with schema validation.