Vulnerability GHSA-33hq-fvwr-56pm
Low Risk
LOW RISK
CVSS Score: 3.0
Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
8 months ago
February 19, 2026 at 08:29 PM UTC
devalue affected by CPU and memory amplification from sparse arrays
<5.6.3
<5.6.3
Summary
devalue affected by CPU and memory amplification from sparse arrays
Details
Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through uneval or stringify.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
High Risk
1 month ago
devalue: `stringify`/`uneval` serialize shared memory
>=5.1.0 <5.9.3 GHSA-j22f-vq7h-c4qm
>=5.1.0 <5.9.3 GHSA-j22f-vq7h-c4qm
Medium Risk
1 month ago
devalue: Residual sparse-array CPU amplification in uneval
<5.9.3 GHSA-hx4r-w6wj-j8fg
<5.9.3 GHSA-hx4r-w6wj-j8fg
High Risk
1 month ago
devalue: Repeated primitive strings cause quadratic expansion in uneval
<5.9.3 GHSA-mcm9-63f2-9j32
<5.9.3 GHSA-mcm9-63f2-9j32
Low Risk
1 month ago
devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
>=1.0.0 <5.9.3 GHSA-wf3x-273g-mvxv
>=1.0.0 <5.9.3 GHSA-wf3x-273g-mvxv
High Risk
1 month ago
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
<5.9.3 GHSA-r9w8-h9r3-54w4
<5.9.3 GHSA-r9w8-h9r3-54w4
Impacted packages
Timeline
Published
8 months ago
February 19, 2026 at 08:29 PM UTC
Fixed (5.6.3)
8 months ago
February 18, 2026 at 05:50 PM UTC
Last Modified
12 hours ago
November 08, 2026 at 10:56 AM UTC