Description
Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.6.2
- Patched version(s): 5.6.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue affected by CPU and memory amplification from sparse arrays and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue: Residual sparse-array CPU amplification in uneval - Vulnerability
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated - Vulnerability
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
You might also like:
See something that needs correcting? Let us knowUpdated February 19, 2026