GHSA-33hq-fvwr-56pm

GHSA-33hq-fvwr-56pm · devalue affected by CPU and memory amplification from sparse arrays

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through `uneval` or `stringify`.

CVSS 6.3 · Mittel · Korrektur verfügbar

Veröffentlicht

2026-02-19T20:29:30Z

Aktualisiert

2026-02-22T23:20:56.552579Z

Technologie-Stack: node

Prüfen Sie Ihren Server →