REDHAT-BUG-2430095: High severity npm/devalue vulnerability
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking the assumption before creating the typed array. This vulnerability is fixed in 5.6.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Svelte devalueto a version that resolves this vulnerability.Fixed in 5.6.2
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2430095?
The severity of REDHAT-BUG-2430095 is high, rated at 7.
What is the risk associated with REDHAT-BUG-2430095?
The risk associated with REDHAT-BUG-2430095 is categorized as 33.
How do I fix REDHAT-BUG-2430095?
To fix REDHAT-BUG-2430095, upgrade the devalue library to version 5.6.2 or later.
What type of vulnerability is identified in REDHAT-BUG-2430095?
REDHAT-BUG-2430095 is a denial of service vulnerability affecting the devalue library.
What versions of the devalue library are affected by REDHAT-BUG-2430095?
Versions of the devalue library from 5.3.0 to 5.6.1 are affected by REDHAT-BUG-2430095.