blakeembrey · blakeembrey · Apr 14, 2026 · Apr 14, 2026
diff --git a/src/function.ts b/src/function.ts
@@ -4,7 +4,6 @@ import { quoteKey, isValidVariableName } from "./quote";
 /**
  * Used in function stringification.
  */
-/* istanbul ignore next */
 const METHOD_NAMES_ARE_QUOTED =
   {
     " "() {

diff --git a/src/index.spec.ts b/src/index.spec.ts
@@ -82,14 +82,16 @@ describe("javascript-stringify", () => {
         "should escape certain unicode sequences",
         test("\u0602", "'\\u0602'"),
       );
+
+      it("should escape < for safety", test("</script>", "'\\u003c/script>'"));
     });
 
     describe("numbers", () => {
       it("should stringify integers", test(10, "10"));
 
       it("should stringify floats", test(10.5, "10.5"));
 
-      it('should stringify "NaN"', test(10.5, "10.5"));
+      it('should stringify "NaN"', test(NaN, "NaN"));
 
       it('should stringify "Infinity"', test(Infinity, "Infinity"));
 
@@ -219,7 +221,20 @@ describe("javascript-stringify", () => {
       });
 
       describe("RegExp", () => {
-        it("should stringify as shorthand", test(/[abc]/gi, "/[abc]/gi"));
+        it(
+          "should stringify as shorthand",
+          test(/[abc]/gi, "new RegExp('[abc]', 'gi')"),
+        );
+
+        it(
+          "should escape slashes",
+          test(new RegExp("a/b"), "new RegExp('a\\\\/b')"),
+        );
+
+        it(
+          "should escape html characters",
+          test(new RegExp("<!--"), "new RegExp('\\u003c!--')"),
+        );
       });
 
       describe("Number", () => {

diff --git a/src/index.ts b/src/index.ts
@@ -66,7 +66,7 @@ export function stringify(
           // Track nodes to restore later.
           if (tracking.has(value)) {
             unpack.set(path.slice(1), tracking.get(value)!);
-            // Use `undefined` as temporaray stand-in for referenced nodes
+            // Use `undefined` as temporary stand-in for referenced nodes.
             return valueToString(undefined, space, onNext, key);
           }
 

diff --git a/src/object.ts b/src/object.ts
@@ -92,7 +92,10 @@ const OBJECT_TYPES: Record<string, ToString> = {
   "[object Map]": (map: Map<any, any>, space: string, next: Next) => {
     return `new Map(${next(Array.from(map))})`;
   },
-  "[object RegExp]": String,
+  "[object RegExp]": (value: RegExp, space: string, next: Next) => {
+    if (!value.flags) return `new RegExp(${next(value.source)})`;
+    return `new RegExp(${next(value.source)}, ${next(value.flags)})`;
+  },
   "[object global]": globalToString,
   "[object Window]": globalToString,
 };
diff --git a/src/quote.ts b/src/quote.ts
@@ -7,7 +7,7 @@ import { Next } from "./types";
  * Source: https://github.com/douglascrockford/JSON-js/blob/master/json2.js
  */
 const ESCAPABLE =
-  /[\\\'\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;
+  /[\\'<\x00-\x1f\x7f-\x9f\u00ad\u0600-\u0604\u070f\u17b4\u17b5\u200c-\u200f\u2028-\u202f\u2060-\u206f\ufeff\ufff0-\uffff]/g;
 
 /**
  * Map of characters to escape characters.

diff --git a/src/stringify.ts b/src/stringify.ts
@@ -16,7 +16,7 @@ const PRIMITIVE_TYPES: Record<string, ToString> = {
     if (key !== undefined) return `Symbol.for(${next(key)})`;
 
     // ES2018 `Symbol.description`.
-    return `Symbol(${next((value as any).description)})`;
+    return `Symbol(${next(value.description)})`;
   },
   bigint: (value: bigint, space: string, next: Next) => {
     return `BigInt(${next(String(value))})`;
-Original file line number
+Diff line change
@@ Expand Up / @@ -4,7 +4,6 @@ import { quoteKey, isValidVariableName } from "./quote"; @@
     /**
      * Used in function stringification.
      */
-    /* istanbul ignore next */
     const METHOD_NAMES_ARE_QUOTED =
       {
         " "() {
@@ Expand Down @@