GHSA-9rgm-9g3h-6x36: Medium severity npm/devalue vulnerability
Impact
devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.
Applications are potentially affected if they call devalue.parse with untrusted data.
Patches
The bug is fixed in devalue@5.9.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/devalueto a version that resolves this vulnerability.Fixed in 5.9.2 - Upgrade
Upgrade
devalueto a version that resolves this vulnerability.Fixed in 5.9.2
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using devalue versions earlier than 5.9.2 are potentially affected when they call devalue.parse with untrusted data.
What does an attacker need to exploit the vulnerability?
An attacker needs to be able to supply a specially crafted payload that is passed to devalue.parse. No privileges or user interaction are required according to the provided severity vector.
What is the impact of successful exploitation?
The crafted payload can cause quadratic work relative to payload size by making devalue alternate between different array representations. This can result in reduced availability.
What version fixes the issue?
Upgrade devalue to version 5.9.2 or later. The issue is fixed in devalue@5.9.2.