devalue@5.1.0

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing a sparse array with a very large index (e.g., arr[1000000] = 1). The function previously used Array.prototype.forEach, which iterates over every logical slot up to the array's length, causing excessive CPU and memory consumption proportional to the declared array length rather than the number of populated elements. An attacker who can supply a serializable value containing a sparse array can trigger this condition to exhaust server resources.

Upgrade devalue to version 5.9.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) via the uneval function when serializing a value containing many repeated long strings or bigint primitives. Each repeated primitive is re-stringified on every reference rather than being deduplicated, causing the output size to grow quadratically with the number of repetitions. An attacker who can supply input to a uneval call can trigger excessive CPU and memory consumption, crashing the process.

Upgrade devalue to version 5.9.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the uneval function in src/uneval.js when processing a sparse array with a very large index (e.g., arr[1000000] = 1). The function previously used forEach to iterate over the logical length of dictionary-backed sparse arrays, causing it to allocate and scan every slot up to the array's length rather than only the populated indices. An attacker who can supply a sparse array value to uneval can trigger excessive memory allocation and CPU consumption, crashing the process.

Upgrade devalue to version 5.9.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Sensitive Information in Resource Not Removed Before Reuse via the viewInfo operation in src/operations.js and the typed-array serialization path in src/uneval.js, when a Node.js Buffer is serialized. Node Buffer instances are backed by a shared memory pool that may contain unrelated, sensitive data beyond the visible bytes of the buffer. Because the library previously serialized the full backing ArrayBuffer rather than only the bytes visible through the Buffer view, an attacker who can influence what gets serialized (for example, during SSR rendering) can cause the full pool contents - including data from other allocations - to be included in the serialized output and exposed to the client.

Upgrade devalue to version 5.9.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parse function. An attacker can cause excessive resource consumption by submitting specially crafted input that triggers repeated alternation between array representations, leading to significant performance degradation.

Upgrade devalue to version 5.9.2 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input in the hydrate() function that can accept __proto__ keys emitted from devalue.parse() or devalue.unflatten() functions. An attacker can manipulate object properties by supplying input that creates objects with a __proto__ own property, which may lead to prototype pollution in downstream code when such objects are merged or assigned.

Upgrade devalue to version 5.6.4 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Prototype Pollution via the parse or unflatten functions. An attacker can manipulate object prototypes by supplying malicious payloads, potentially causing denial of service or type confusion.

Upgrade devalue to version 5.6.4 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Prototype Pollution via the uneval method. An attacker can manipulate object prototypes by supplying specially crafted untrusted data that, when processed and later evaluated, results in objects with altered prototypes.

Upgrade devalue to version 5.6.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the uneval() or stringify() functions. An attacker can cause CPU and memory exhaustion by submitting specially crafted sparse arrays.

Upgrade devalue to version 5.6.3 or higher.

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Asymmetric Resource Consumption (Amplification) due to the improper validation in ArrayBuffer if input string is base64 encoded in the hydration() function when parsing data from untrusted sources. An attacker can cause excessive memory allocation and CPU usage by submitting specially crafted input, potentially leading to resource exhaustion and service disruption.

Upgrade devalue to version 5.6.2 or higher.