Description
stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.1.0, <= 5.9.2
- Patched version(s): 5.9.3
References
Could your website be exposed too?
SmartScanner can check your website for devalue: `stringify`/`uneval` serialize shared memory and gives you actionable findings to investigate.
Start a free scanRelated Issues
- devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse - CVE-2026-22775
- Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774
- ExifReader: DoS via Crafted HEIC/AVIF iloc Box - Memory Exhaustion - CVE-2026-85715
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
You might also like:
See something that needs correcting? Let us knowUpdated October 01, 2026