GHSA-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
- Risk score
- 59/100
- CVSS
- 8.2 v4.0
- Published
- 1 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous …
- Affected
- devalue (npm) >= 5.8.0, <= 5.9.2
- Fix
- Upgrade devalue to 5.9.3 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 8.2 high
- Remotely exploitable without logging in
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| devalue | npm | >= 5.8.0, <= 5.9.2 | 5.9.3 |
References
- https://github.com/advisories/GHSA-x5rw-q4pp-hg5g
- https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g
- https://github.com/sveltejs/devalue/commit/dae8153e9d7541b975cc4018138d6cebec6c1199
- https://github.com/sveltejs/devalue/releases/tag/v5.9.3
- https://github.com/advisories/GHSA-x5rw-q4pp-hg5g
Original description
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed. This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.
Last activity 1 Oct 2026. Patch Forecast updates every hour.