Description
Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion - Vulnerability
- devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise - Vulnerability
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 17, 2026