{"schema":"threatline.record/2","record":{"id":"CVE-2026-92708","aliases":["GHSA-j22f-vq7h-c4qm"],"summary":"devalue: `stringify`/`uneval` serialize shared memory","details":"### Impact\n\n`stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. In the case of a Node `Buffer` object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node `Buffer` the backing store is Node's **process-wide shared pool**, so serializing a small `Buffer` copies up to 64 KB of unrelated process memory — including bytes from other in-flight requests — into the output. In an SSR framework (SvelteKit, Nuxt) a public page whose `load()` returns a 2-byte `Buffer`, or a small file read with `readFileSync`, ships another user's request body / `Authorization` header in its HTML. Unauthenticated, silent, ~43,000× amplification.\n\nThis is serialization-side, so the `parse`/`unflatten` prototype-pollution and DoS guards do not apply — it fires on every SSR render, not only when parsing untrusted input.\n\n### Workarounds\n\nConvert Node `Buffer` objects to `Uint8Array`:\n\n```diff\npayload = {\n- buffer\n+ buffer: new Uint8Array(buffer)\n}\n```","categories":["Libraries & packages"],"product":"devalue","vendor":"sveltejs","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-j22f-vq7h-c4qm","source_modified_at":"2026-10-01T15:18:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"devalue"},"range":">= 5.1.0, <= 5.9.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-92708","source_modified_at":"2026-09-23T19:38:36.551Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"devalue","vendor":"sveltejs","versions":[{"version":">= 5.1.0, < 5.9.3","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j22f-vq7h-c4qm","source_modified_at":"2026-10-01T15:30:12.678757365Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"devalue","ecosystem":"npm","purl":"pkg:npm/devalue"},"ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.9.3"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-j22f-vq7h-c4qm","source_modified_at":"2026-10-01T15:18:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"devalue"},"version":"5.9.3"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-j22f-vq7h-c4qm","source_modified_at":"2026-10-01T15:30:12.678757365Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"devalue","ecosystem":"npm","purl":"pkg:npm/devalue"},"version":"5.9.3"}],"cvss":7.5,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00725,"percentile":0.53566,"score_date":"2026-10-23"},"published_at":"2026-09-18T19:54:28.335Z","modified_at":"2026-10-01T15:30:12.678757365Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-j22f-vq7h-c4qm","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-01T15:18:07Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-92708","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-09-23T19:38:36.551Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-j22f-vq7h-c4qm","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-01T15:30:12.678757365Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-92708","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["GitHub Advisory Database","CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92708","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-j22f-vq7h-c4qm","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","ssvc":{"exploitation":"none","automatable":"yes","technical_impact":"partial","assessed_at":"2026-09-23T19:38:28.127737Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-01T15:30:12.678757365Z","content_hash":"43b42d55ec237f7d0c04032993f0be379b2cbe048a71f9298a263a78a1d11388"}}