Description
Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue affected by CPU and memory amplification from sparse arrays - Vulnerability
- devalue: Residual sparse-array CPU amplification in uneval - Vulnerability
- devalue: Repeated primitive strings cause quadratic expansion in uneval - Vulnerability
- devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed - Vulnerability
You might also like:
See something that needs correcting? Let us knowUpdated October 01, 2026