All vulnerabilities
GHSA-wf3x-273g-mvxv

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

devaluenpmLibraries & packages
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.9.3Fixed versionGitHub
Published1 Oct 2026Updated 1 Oct 2026GitHub

What fixes it

  • 5.9.3devalue, npmGitHubnpm install devalue@5.9.3

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.

You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.

Text from GitHub Advisory Database

Affected versions 2

  • devalue, npm>= 1.0.0, <= 5.9.2GitHub
  • devalue, npmfrom 1.0.0, fixed in 5.9.3OSV

References 4