All vulnerabilities
GHSA-r9w8-h9r3-54w4

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

devaluenpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.2High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.9.3Fixed versionGitHub
Published1 Oct 2026Updated 17 Oct 2026GitHub

What fixes it

  • 5.9.3devalue, npmGitHubnpm install devalue@5.9.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.

Text from GitHub Advisory Database

Affected versions 2

  • devalue, npm<= 5.9.2GitHub
  • devalue, npmfrom first release, fixed in 5.9.3OSV

References 4