Description
Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: Repeated primitive strings cause quadratic expansion in uneval and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated - Vulnerability
- devalue: Residual sparse-array CPU amplification in uneval - Vulnerability
- devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise - Vulnerability
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 01, 2026