GHSA-wf3x-273g-mvxv: Npm/devalue vulnerability
Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.
You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/devalueto a version that resolves this vulnerability.Fixed in 5.9.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications are affected only if they serialize very large sparse arrays with `uneval` and later evaluate the generated output in a browser or runtime. Default `parse` handling of sparse arrays is not affected.
What does exploitation require?
An attacker would need to cause a consumer to evaluate `uneval` output representing a sparse array with a very large declared length. A small serialized payload can then trigger memory allocation proportional to that length.
What is the likely impact for client-side use?
For the general use case of sending `uneval` data to a client, the stated worst-case impact is that the browser tab runs out of memory.
How can I tell whether my application is affected?
Review whether your application uses `uneval` to serialize very large sparse arrays and evaluates the resulting code. Uses limited to default `parse` sparse-array construction are not affected.