CVE-2026-22775: devalue Denial of Service Vulnerability Due to Memory/CPU Exhaustion
Summary
CVE-2026-22775: devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse. Affects devalue versions >= 5.1.0, < 5.6.2. Fixed in 5.6.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
devalue is an npm package designed for parsing and serializing JavaScript values. It is commonly used in applications that require data transformation and manipulation. However, it has a vulnerability that can be exploited when handling untrusted input, leading to potential denial of service due to excessive resource consumption.
Vulnerability Detail
The vulnerability arises from the devalue.parse function, which does not adequately validate input before processing. Specifically, the ArrayBuffer hydration logic assumes that input will be base64 encoded strings without verifying this assumption. This oversight allows specially crafted inputs to cause excessive memory allocation and CPU usage, potentially leading to denial of service in systems that rely on this function to parse data from untrusted sources.
How To Fix
Latest published version: 6.0.3 as of 23 Oct 2026
npm install devalue@6.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.6.2
This is the first release that contains the fix.
npm install devalue@5.6.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using devalue.parse with untrusted input until you can upgrade to the patched version. Additionally, implement input validation to ensure that only expected formats are processed.
Conclusion
The devalue package has a significant vulnerability that can lead to denial of service due to improper input validation in the devalue.parse function. It is crucial for users of this package to upgrade to version 5.6.2 or later to mitigate the risk. Implementing input validation and monitoring tools like Vulert can help manage and prevent such vulnerabilities.
See every vulnerability recorded for devalue →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Versions of devalue prior to 5.6.2 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot upgrade immediately, avoid using devalue.parse with untrusted inputs and implement strict input validation as a temporary measure.
More information can be found in the advisory published on GitHub and the CVE details page for CVE-2026-22775.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
