Memory Allocation with Excessive Size Value Affecting devalue package, versions >=1.0.0 <5.9.3
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JS-DEVALUE-20416742
- published4 Oct 2026
- disclosed1 Oct 2026
- creditUnknown
Introduced: 1 Oct 2026
New CVE NOT AVAILABLE CWE-789 (opens in a new tab)How to fix?
Upgrade devalue to version 5.9.3 or higher.
Overview
devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.
Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the uneval function in src/uneval.js when processing a sparse array with a very large index (e.g., arr[1000000] = 1). The function previously used Array.prototype.forEach, which iterates over every logical slot up to the array's length, causing excessive CPU and memory consumption proportional to the declared array length rather than the number of populated elements. An attacker who can supply a serializable value containing a sparse array can trigger this condition to exhaust server resources.