GHSA-mcm9-63f2-9j32: Npm/devalue vulnerability
Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/devalueto a version that resolves this vulnerability.Fixed in 5.9.3
Event History
Frequently Asked Questions
What input flow is affected?
The issue affects data that is first processed with `parse` and then passed to `uneval`, where a small payload can become a very large serialized string.
What conditions are required for exploitation?
The advisory describes exploitation as requiring very constrained circumstances. The provided information does not identify broader affected configurations or additional prerequisites.
What should be done to remediate the issue?
A release tagged v5.9.3 is referenced alongside the security advisory and fixing commit. Update to that release or later if applicable.