devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

devalue: Residual sparse-array CPU amplification in uneval

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...

NPM: devalue: Residual sparse-array CPU amplification in uneval

NPM: devalue: Residual sparse-array CPU amplification in uneval vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...

GHSA-HX4R-W6WJ-J8FG devalue: Residual sparse-array CPU amplification in uneval

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to...

Inefficient Algorithmic Complexity

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse...

NPM: devalue: Repeated primitive strings cause quadratic expansion in uneval

NPM: devalue: Repeated primitive strings cause quadratic expansion in uneval vulnerability discovered by ? in WordPress Npm devalue versions = 5.9.2...

devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string...

GHSA-MCM9-63F2-9J32 devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the uneval function when serializi...

NPM: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

NPM: devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated vulnerability discovered by ? in WordPress Npm devalue versions = 1.0.0, = 5.9.2...

GHSA-WF3X-273G-MVXV devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array...

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array...

Memory Allocation with Excessive Size Value

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing ...

CVE-2026-92708

A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

PT-2026-95695

Name of the Vulnerable Software and Affected Versions Svelte devalue versions 5.1.0 through 5.9.2 Description The stringify and uneval functions serialize typed arrays by emitting the entire backing ArrayBuffer instead of only the view. When serializing a Node Buffer, which uses a process-wide...

CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...