GHSA-33hq-fvwr-56pm

GHSA-33hq-fvwr-56pm · devalue affected by CPU and memory amplification from sparse arrays

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through `uneval` or `stringify`.

CVSS 6.3 · Medium · Fix available

Published

2026-02-19T20:29:30Z

Updated

2026-02-22T23:20:56.552579Z

Stack: node

Check your server →