GHSA-33hq-fvwr-56pm

GHSA-33hq-fvwr-56pm · devalue affected by CPU and memory amplification from sparse arrays

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through `uneval` or `stringify`.

CVSS 6.3 · Media · Corrección disponible

Publicación

2026-02-19T20:29:30Z

Actualización

2026-02-22T23:20:56.552579Z

Pila tecnológica: node

Comprueba tu servidor →