GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated
Evaluating sparse array output from devalue's uneval function can cause excessive memory allocation, leading to denial of service in consuming environments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wf3x-273g-mvxv?
GHSA-wf3x-273g-mvxv is a denial of service vulnerability in devalue, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.
You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.
Which versions are affected by GHSA-wf3x-273g-mvxv?
2 open source packages ship an affected version, including devalue.
| Package | Affected | Fixed in |
|---|---|---|
devalue npm | From 1.0.0 | 5.9.3 |
devalue npm | From 1.0.0 | 5.9.3 |
How do I fix GHSA-wf3x-273g-mvxv?
Upgrade devalue to 5.9.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-wf3x-273g-mvxv being exploited?
There is no known exploitation of GHSA-wf3x-273g-mvxv in the wild and no public exploit code.