Nemanja Maksimovic was put through one-on-one with keeper Jean in the 118th minute and made no mistake with his finish.
It meant a first FIFA crown for Serbia - Yugoslavia had won the U-20 tournament in 1987 - and it did it by having to go through extra time for a fourth consecutive match.
Earlier, Maksimovic set up Stanisa Mandic to open the scoring on 70 minutes only for Brazil substitute Andreas Pereira to send the game to extra time with a leveller in the 73rd minute.
The final before a full house of 25,317 on Saturday featured plenty of possession for the Brazilians, who had to try to unpick their opponents' defensive solidity.
Seeking a record-equalling sixth title, Brazil made most of the running in the opening half, and Real Madrid attacker Jean Carlos and then Gabriel Jesus forced early saves from keeper Predrag Rajkovic.
Serbia, which put plenty of men behind the ball and then tried to hit on the counter, almost went ahead just out from half-time, Sergej Milinkovic's header from a corner kept out by a diving Jean.
Serbia broke the deadlock in the 70th minute with Mandic turning in a Maksimovic cross from two yards.
The lead lasted just three minutes thanks to Pereira, the Manchester United midfielder dribbling past four defenders before firing home the equaliser.
Pereira had the chance to win the contest in stoppage time, his free kick evading the wall, but not the keeper.
Mali claimed third place with a 3-1 come from behind win over 10-man Senegal in an all-African affair.
After an even first half, the send off of Senegal's Moussa Ba on the stroke of half-time changed the complexion of the game.
However, Senegal did manage to take the lead though Ibrahima Wadji on 64 minutes before Adama Traore scored twice for Mail on 74 and 83 minutes to turn the game on its head.
Diadie Samassekou sealed the deserved victory with a goal a minute into stoppage time.
The entertaining match included two saved penalties - one from either side - amid incessant rain in Auckland that helped produce an open affair.
