GitHub Advisoryadvisory · npm

GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

LOW Published 2026-10-01 Modified 2026-10-01 Official page ↗
Ecosystem
npm
Packages
devalue
Severity
Low
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L
Weaknesses
CWE-400, CWE-789
Reviewed
2026-10-01

Affected packages

• npm devalue: >= 1.0.0, < 5.9.3 → fixed in 5.9.3

Description

Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default `parse` sparse-array construction. You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for `uneval` of sending data to the client, the worst that could happen is the browser tab running out of memory.

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-789 Memory Allocation with Excessive Size Value weakness

References