141 matches found
CLSA-2026-1790965180 TuxCare security update for devalue (3 CVEs)
TuxCare rebuilt devalue to address 3 CVEs. Fixed in 5.9.0-tuxcare.3...
NPM: devalue: `stringify`/`uneval` serialize shared memory
NPM: devalue: stringify/uneval serialize shared memory vulnerability discovered by ? in WordPress Npm devalue versions = 5.1.0, = 5.9.2...
EUVD-2026-83362
devalue: stringify/uneval serialize shared memory...
NPM: devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
NPM: devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...
CLSA-2026-1790606671 TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.1-tuxcare.2...
CLSA-2026-1790605435 TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.0-tuxcare.2...
CLSA-2026-1790161447 TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.2-tuxcare.3...
CVE-2026-92708
A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...
Sensitive Information in Resource Not Removed Before Reuse
Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse via the viewInfo operation in...
CVE-2026-92708
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
CVE-2026-92708
Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...
CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
CLSA-2026-1789752547 TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.3-tuxcare.5...
CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...
GHSA-9RGM-9G3H-6X36 Svelte devalue: DoS via malformed input
Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...
Svelte devalue: DoS via malformed input
Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...