GHSA-mcm9-63f2-9j32

GHSA-mcm9-63f2-9j32 · devalue: Repeated primitive strings cause quadratic expansion in uneval

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.

CVSS 8.2 · High · Fix available

Published: 2026-10-01T15:17:29Z
Updated: 2026-10-01T15:30:12.676095253Z

Stack: node

Affected products and versions

devalue npm
Affected ranges
- SEMVER: < 5.9.3
Update to 5.9.3

Original sources

https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32
https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
https://github.com/sveltejs/devalue
https://github.com/sveltejs/devalue/releases/tag/v5.9.3
https://osv.dev/vulnerability/GHSA-mcm9-63f2-9j32

Check your server →

GHSA-mcm9-63f2-9j32 · devalue: Repeated primitive strings cause quadratic expansion in uneval

Affected products and versions

devalue npm

Original sources