CVE-2026-22774: Devalue Package Denial of Service Vulnerability Due to Memory Exhaustion
Summary
CVE-2026-22774: Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse. Affects devalue versions >= 5.3.0, < 5.6.2. Fixed in 5.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Devalue is a JavaScript library used for serializing and deserializing JavaScript objects. It is commonly utilized in applications that require data interchange between different systems. The library's functionality includes parsing and converting data structures efficiently. However, it has a vulnerability that can lead to denial of service when handling untrusted input, making it critical for developers to be aware of its limitations.
Vulnerability Detail
The vulnerability arises from the devalue.parse function, which does not adequately validate input before processing. Specifically, it expects an ArrayBuffer for typed array hydration but fails to check this assumption. As a result, specially crafted inputs can lead to excessive memory allocation or CPU usage, potentially causing denial of service in applications that rely on devalue.parse to handle external data. This vulnerability can severely impact systems that process untrusted input, leading to performance degradation or crashes.
How To Fix
Latest published version: 6.0.3 as of 23 Oct 2026
npm install devalue@6.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.6.2
This is the first release that contains the fix.
npm install devalue@5.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can implement input validation before passing data to devalue.parse. Ensure that any data being parsed is from a trusted source and conforms to expected formats to minimize the risk of triggering the vulnerability.
Conclusion
The devalue package has a significant vulnerability (CVE-2026-22774) that can lead to denial of service due to memory exhaustion when processing untrusted input. It is crucial for developers to upgrade to version 5.6.2 or later to mitigate this risk. Implementing input validation can serve as a temporary workaround while transitioning to the patched version.
See every vulnerability recorded for devalue →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By uploading your package-lock.json file, you can check for vulnerabilities without needing to access the code directly.
The potential impacts include denial of service, where the application may consume excessive CPU and memory resources, leading to performance issues or crashes.
Yes, version 5.6.2 and later of the devalue package contains the necessary patches to address this vulnerability.
If an immediate upgrade is not possible, implement input validation to ensure that only trusted data is processed by devalue.parse.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
