Description
uneval performs synchronous work proportional to a sparse array’s declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: Residual sparse-array CPU amplification in uneval and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue affected by CPU and memory amplification from sparse arrays - Vulnerability
- devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated - Vulnerability
- devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation - Vulnerability
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 01, 2026