Description
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.3.0, <= 5.6.1
- Patched version(s): 5.6.2
References
Could your website be exposed too?
SmartScanner can check your website for Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
- parse-duration has a Regex Denial of Service that results in event loop delay and out of memory - CVE-2025-25283
- html-parse-stringify and html-parse-stringify2 vulnerable to Regular expression denial of service (ReDoS) - CVE-2021-23346
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
You might also like:
See something that needs correcting? Let us knowUpdated January 15, 2026