devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

Description

Certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data.

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.1.0, < 5.6.2
• Patched version(s): 5.6.2

References

• GHSA-g2pg-6438-jwpf
• CVE-2026-22775
• CWE-405
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse - CVE-2026-22774
• Astros's duplicate trailing slash feature leads to an open redirection security issue - CVE-2025-54793
• jsondiffpatch is vulnerable to Cross-site Scripting (XSS) via HtmlFormatter::nodeBegin - CVE-2025-9910
• Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751

Tags:

npm

devalue