GHSA-hx4r-w6wj-j8fg

GHSA-hx4r-w6wj-j8fg · devalue: Residual sparse-array CPU amplification in uneval

This page contains facts from public vulnerability sources. Check the original advisory before updating.

`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.

CVSS 6.3 · Medium · Fix available

Published

2026-10-01T15:17:42Z

Updated

2026-10-01T15:30:12.679856219Z

Stack: node

Check your server →