From 14e54f83e5481f3611b692a77dadc1a96cd74816 Mon Sep 17 00:00:00 2001
From: TorMatzAndren <tmw82x@gmail.com>
Date: Fri, 23 Oct 2026 21:05:20 +0200
Subject: [PATCH 1/2] test: cover uppercase script closing tags in function
 bodies

---
 test/unit/serialize.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/test/unit/serialize.js b/test/unit/serialize.js
index e7b2acc..17359ca 100644
--- a/test/unit/serialize.js
+++ b/test/unit/serialize.js
@@ -643,6 +643,16 @@ describe('serialize( obj )', function () {
             strictEqual(deserialized(), '</script>');
         });
 
+        it('should encode case-insensitive script close tags in function bodies', function () {
+            function fn() { return '</SCRIPT>'; }
+            var serialized = serialize(fn);
+
+            strictEqual(CLOSES_SCRIPT.test(serialized), false);
+
+            var deserialized; eval('deserialized = ' + serialized);
+            strictEqual(deserialized(), '</SCRIPT>');
+        });
+
         // A `</script` only ends the script element when the next character
         // is one the HTML tokenizer accepts as ending the tag name. Followed
         // by anything else it is emitted as text, so that is what must be

From 2c3bae1c888caa382639a74d89ef43417df57530 Mon Sep 17 00:00:00 2001
From: TorMatzAndren <tmw82x@gmail.com>
Date: Fri, 23 Oct 2026 21:10:34 +0200
Subject: [PATCH 2/2] test: cover mixed-case and script-close delimiter
 variants

---
 test/unit/serialize.js | 29 +++++++++++++++++++++--------
 1 file changed, 21 insertions(+), 8 deletions(-)

diff --git a/test/unit/serialize.js b/test/unit/serialize.js
index 17359ca..1b10700 100644
--- a/test/unit/serialize.js
+++ b/test/unit/serialize.js
@@ -643,14 +643,27 @@ describe('serialize( obj )', function () {
             strictEqual(deserialized(), '</script>');
         });
 
-        it('should encode case-insensitive script close tags in function bodies', function () {
-            function fn() { return '</SCRIPT>'; }
-            var serialized = serialize(fn);
-
-            strictEqual(CLOSES_SCRIPT.test(serialized), false);
-
-            var deserialized; eval('deserialized = ' + serialized);
-            strictEqual(deserialized(), '</SCRIPT>');
+        it('should encode mixed-case and delimiter variants in function bodies', function () {
+            // These escapes create actual LF, CR, and FF characters in each
+            // returned value. Serialization must keep the source safe and
+            // preserve those values after deserialization.
+            var payloads = [
+                '</sCrIpT>',
+                '</script/x>',
+                '</script\n>',
+                '</script\r>',
+                '</script\f>'
+            ];
+
+            payloads.forEach(function (payload) {
+                var fn = new Function('return ' + JSON.stringify(payload));
+                var serialized = serialize(fn);
+
+                strictEqual(CLOSES_SCRIPT.test(serialized), false);
+
+                var deserialized; eval('deserialized = ' + serialized);
+                strictEqual(deserialized(), payload);
+            });
         });
 
         // A `</script` only ends the script element when the next character