Description
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.3.0, <= 5.6.1
- Patched version(s): 5.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
- jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder - CVE-2026-24133
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
You might also like:
See something that needs correcting? Let us knowUpdated January 15, 2026