REDHAT-BUG-2487050: High severity npm/devalue vulnerability
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
devalue.parseto a version that resolves this vulnerability.Fixed in 5.8.1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487050?
The severity of REDHAT-BUG-2487050 is classified as high with a score of 7.
What are the affected versions in REDHAT-BUG-2487050?
Versions from 5.6.3 to before 5.8.1 of the devalue library are affected by REDHAT-BUG-2487050.
What is the main issue in REDHAT-BUG-2487050?
The main issue is that devalue.parse can allocate excessive memory due to quirks in certain JavaScript engines.
How do I fix REDHAT-BUG-2487050?
To fix REDHAT-BUG-2487050, upgrade the devalue library to version 5.8.1 or later.
What kind of applications are impacted by REDHAT-BUG-2487050?
Applications that use the devalue library for serialization in JavaScript are impacted by REDHAT-BUG-2487050.