GHSA-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
- Risk score
- 59/100
- CVSS
- 8.2 v4.0
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.
- Affected
- devalue (npm) <= 5.9.2
- Fix
- Upgrade devalue to 5.9.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| devalue | npm | <= 5.9.2 | 5.9.3 |
References
- https://github.com/advisories/GHSA-r9w8-h9r3-54w4
- https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
- https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99
- https://github.com/sveltejs/devalue/releases/tag/v5.9.3
- https://github.com/advisories/GHSA-r9w8-h9r3-54w4
Original description
Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.
Last activity 1 Oct 2026. Patch Forecast updates every hour.