GHSA-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
- Risk score
- 59/100
- CVSS
- 8.2 v4.0
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.
- Affected
- devalue (npm) <= 5.9.2
- Fix
- Upgrade devalue to 5.9.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| devalue | npm | <= 5.9.2 | 5.9.3 |
References
- https://github.com/advisories/GHSA-mcm9-63f2-9j32
- https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32
- https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
- https://github.com/sveltejs/devalue/releases/tag/v5.9.3
- https://github.com/advisories/GHSA-mcm9-63f2-9j32
Original description
Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.
Last activity 1 Oct 2026. Patch Forecast updates every hour.