What is insecure deserialization? Where does it show up in Node.js?

Deserialization turns text or bytes back into objects. It is insecure when the format can create live objects or run code, and an attacker controls the input. Java serialization, PHP unserialize and Python pickle are the classic cases.

In Node.js it shows up in these places:

• node-serialize: its unserialize() rebuilds functions from strings. A function written as an IIFE (a function that calls itself) runs during parsing. This was CVE-2017-5941.
• YAML: js-yaml version 3's load() could build JavaScript functions from tags like !!js/function. Use version 4, where load() is safe by default.
• eval, new Function and vm used on input. Node's docs say the vm module is not a security mechanism.
• Unsafe merges after parsing: JSON.parse is safe on its own, but a deep merge of the result can copy a __proto__ key. That is prototype pollution.

Defences:

• Use data-only formats such as JSON. They can't carry code.
• Validate the parsed result with a schema before you use it.
• Never pick a class or function based on a name in the input.
• Sign data that you later trust back, such as session state in a cookie, so tampering is detected.
• Keep parsers patched.