GHSA-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
devaluenpmLibraries & packages
CVSS
8.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.9.3devalue, npmGitHub
npm install devalue@5.9.3
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.
This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.
Text from GitHub Advisory Database
Affected versions 2
- devalue, npm>= 5.8.0, <= 5.9.2GitHub
- devalue, npmfrom 5.8.0, fixed in 5.9.3OSV