Description
Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.1.0, < 5.6.2
- Patched version(s): 5.6.2
References
Could your website be exposed too?
SmartScanner can check your website for devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774
- Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
- Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer - CVE-2026-41680
- React Router vulnerable to Denial of Service via reflected user input in single-fetch - CVE-2026-34077
You might also like:
See something that needs correcting? Let us knowUpdated January 15, 2026