CLSA-2026-1791666988 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.4...

CLSA-2026-1791666885 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.3-tuxcare.6...

CLSA-2026-1791666797 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.1-tuxcare.4...

CLSA-2026-1791666589 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.2-tuxcare.4...

CLSA-2026-1791626697 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 2.0.1-tuxcare.5...

CLSA-2026-1791626600 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.1-tuxcare.3...

CLSA-2026-1791626432 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.0-tuxcare.4...

CLSA-2026-1790965180 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 5.9.0-tuxcare.3...

CLSA-2026-1790939353 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.2...

CLSA-2026-1790937656 TuxCare security update for devalue (4 CVEs)

TuxCare rebuilt devalue to address 4 CVEs. Fixed in 5.9.1-tuxcare.1...

CLSA-2026-1790888237 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.1...

CLSA-2026-1790888210 TuxCare security update for devalue (5 CVEs)

TuxCare rebuilt devalue to address 5 CVEs. Fixed in 5.9.2-tuxcare.1...

NPM: devalue: `stringify`/`uneval` serialize shared memory

NPM: devalue: stringify/uneval serialize shared memory vulnerability discovered by ? in WordPress Npm devalue versions = 5.1.0, = 5.9.2...

EUVD-2026-83362

devalue: stringify/uneval serialize shared memory...

GHSA-J22F-VQ7H-C4QM devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by CVE-2026-92708 via devalue (>=5.1.1, <=5.9.2)

devalue NPM version =5.1.1, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: CVE-2026-92708 Source advisory: OSV:GHSA-J22F-VQ7H-C4QM...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by CVE-2026-92708 via devalue (>=5.1.1, <=5.9.2)

devalue NPM version =5.1.1, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: CVE-2026-92708 Source advisory: GHSA-J22F-VQ7H-C4QM...

@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +134 more potentially affected by unknown CVE via devalue (>=5.0.0, <=5.9.2)

devalue NPM version =5.0.0, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: unknown CVE Source advisory: SNYK:JS-DEVALUE-20416736...

NPM: devalue: Residual sparse-array CPU amplification in uneval

NPM: devalue: Residual sparse-array CPU amplification in uneval vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...

Inefficient Algorithmic Complexity

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...