All vulnerabilities
GHSA-hx4r-w6wj-j8fg

devalue: Residual sparse-array CPU amplification in uneval

devaluenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.9.3Fixed versionGitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 5.9.3devalue, npmGitHubnpm install devalue@5.9.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.

Text from GitHub Advisory Database

Affected versions 2

  • devalue, npm<= 5.9.2GitHub
  • devalue, npmfrom first release, fixed in 5.9.3OSV

References 4