Vulnerability Database

CLSA-2026-1790965180

TuxCare:npm/devalue

TuxCare security update for devalue (3 CVEs) 3 days ago

Fix available

CLSA-2026-1790939353

TuxCare:npm/devalue

TuxCare security update for devalue (1 CVE) 4 days ago

Fix available

CLSA-2026-1790937656

TuxCare:npm/devalue

TuxCare security update for devalue (4 CVEs) 4 days ago

Fix available

CLSA-2026-1790888237

TuxCare:npm/devalue

TuxCare security update for devalue (1 CVE) 4 days ago

Fix available

CLSA-2026-1790888210

TuxCare:npm/devalue

TuxCare security update for devalue (5 CVEs) 4 days ago

Fix available

GHSA-j22f-vq7h-c4qm

npm/devalue

devalue: `stringify`/`uneval` serialize shared memory 4 days ago

Fix available
Severity - 7.5 (High)

GHSA-hx4r-w6wj-j8fg

npm/devalue

devalue: Residual sparse-array CPU amplification in uneval 4 days ago

Fix available
Severity - 6.3 (Medium)

GHSA-mcm9-63f2-9j32

npm/devalue

devalue: Repeated primitive strings cause quadratic expansion in uneval 4 days ago

Fix available
Severity - 8.2 (High)

GHSA-wf3x-273g-mvxv

npm/devalue

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated 4 days ago

Fix available
Severity - 2.3 (Low)

GHSA-r9w8-h9r3-54w4

npm/devalue

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation 4 days ago

Fix available
Severity - 8.2 (High)

GHSA-x5rw-q4pp-hg5g

npm/devalue

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise 4 days ago

Fix available
Severity - 8.2 (High)

GHSA-4q55-j62x-fr9h

npm/devalue

devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion 4 days ago

Fix available
Severity - 6.3 (Medium)

CLSA-2026-1790606671

TuxCare:npm/devalue

TuxCare security update for devalue (2 CVEs) 28 Sep

Fix available

CLSA-2026-1790605435

TuxCare:npm/devalue

TuxCare security update for devalue (2 CVEs) 28 Sep

Fix available

CLSA-2026-1790161447

TuxCare:npm/devalue

TuxCare security update for devalue (2 CVEs) 23 Sep

Fix available

CVE-2026-92708

github.com/sveltejs/devalue

devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers 18 Sep

Fix available
Severity - 7.5 (High)

Vulnerabilities