GHSA-wf3x-273g-mvxv

Source

https://github.com/advisories/GHSA-wf3x-273g-mvxv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-wf3x-273g-mvxv/GHSA-wf3x-273g-mvxv.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-wf3x-273g-mvxv

Downstream

CLSA-2026-1790888210

Published

2026-10-01T15:17:13Z

Modified

2026-10-01T15:30:13Z

Severity

2.3 (Low) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L CVSS Calculator

Summary

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Details

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.

You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.

Database specific

{
    "cwe_ids":  [
        "CWE-400",
        "CWE-789"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-01T15:17:13Z",
    "nvd_published_at":  null,
    "severity":  "LOW"
}

References

Affected packages

npm / devalue

Package

Name: devalue; View open source insights on deps.dev
Purl: pkg:npm/devalue

Affected ranges

Type: SEMVER
Events: Introduced

1.0.0

Fixed

5.9.3

Database specific

last_known_affected_version_range

"<= 5.9.2"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-wf3x-273g-mvxv/GHSA-wf3x-273g-mvxv.json"