Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

Description

Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data.

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.3.0, <= 5.6.1
• Patched version(s): 5.6.2

References

• GHSA-vw5p-8cq8-m7mv
• CVE-2026-22774
• CWE-20
• CWE-405
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
• jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939

Tags:

npm

devalue