devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.
You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | devalue | >= 1.0.0, < 5.9.3 | 5.9.3 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L- Weakness (CWE)
CWE-400, CWE-789- Platform
- npm
- Package
devalue- Disclosed
- 01.10.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-wf3x-273g-mvxv - CC BY 4.0
Vulnerability history: devalue
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 16
- First → latest
- 08.2025 10.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 8
- Medium 4
- Low 4
Disclosures per year
- 2025: 1
- 2026: 15
-
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.