GHSA-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
- Risk score
- 43/100
- CVSS
- 6.3 v4.0
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
- Affected
- devalue (npm) <= 5.9.2
- Fix
- Upgrade devalue to 5.9.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| devalue | npm | <= 5.9.2 | 5.9.3 |
References
- https://github.com/advisories/GHSA-hx4r-w6wj-j8fg
- https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg
- https://github.com/sveltejs/devalue/commit/6861dbbb7e548849e48bce718e88747a298f7250
- https://github.com/sveltejs/devalue/releases/tag/v5.9.3
- https://github.com/advisories/GHSA-hx4r-w6wj-j8fg
Original description
`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
Last activity 1 Oct 2026. Patch Forecast updates every hour.