CVE-2026-123569

The devalue package for npm before version 5.6.3 is vulnerable to a Denial of Service (DoS) attack. The issue occurs because the uneval or stringify functions consume excessive CPU and memory when serializing sparse arrays . An attacker who can cause a sparse array to be created on the server—a s...