All vulnerabilities
GHSA-mcm9-63f2-9j32

devalue: Repeated primitive strings cause quadratic expansion in uneval

devaluenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.9.3Fixed versionGitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 5.9.3devalue, npmGitHubnpm install devalue@5.9.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.

Text from GitHub Advisory Database

Affected versions 2

  • devalue, npm<= 5.9.2GitHub
  • devalue, npmfrom first release, fixed in 5.9.3OSV

References 4