Critical ArrayBuffer Reviver Bypass in devalue Package
Summary
GHSA-r9w8-h9r3-54w4: devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation. Affects devalue versions < 5.9.3. Fixed in 5.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The devalue package is a JavaScript library used for serializing and deserializing JavaScript objects, particularly for handling complex data types like ArrayBuffers. It is widely utilized in applications that require efficient data transfer and storage. However, a vulnerability exists that allows custom ArrayBuffer revivers to bypass typed-array allocation validation, posing significant risks to applications relying on this package.
Vulnerability Detail
The vulnerability arises from the way the devalue package handles custom revivers for ArrayBuffers. Under specific conditions, it is possible for the 'parse' function to create excessively large ArrayBuffers from minimal input, particularly when a malformed ArrayBuffer custom reviver is employed. This can lead to denial-of-service attacks or excessive memory consumption, potentially crashing applications or exposing them to further exploits.
How To Fix
Minimum fixed version
5.9.3
This is the first release that contains the fix.
npm install devalue@5.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, developers can avoid using custom revivers for ArrayBuffers until the package is updated. Additionally, implementing input validation to ensure that only expected data types are processed can help mitigate the risk.
Conclusion
In summary, the devalue package has a critical vulnerability that allows for the bypass of typed-array allocation validation through custom ArrayBuffer revivers. Users are strongly advised to update to version 5.9.3 or later to mitigate this risk. Temporary workarounds are available, but the best course of action is to apply the patch as soon as possible.
See every vulnerability recorded for devalue →
FAQ
The vulnerability has a CVSS score of 8.2, indicating a high severity level that could lead to significant impacts on affected applications.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By utilizing the Vulert playground, you can check your application without any signup.
Exploiting this vulnerability can lead to denial-of-service attacks, excessive memory usage, and potential crashes of applications that rely on the devalue package.
Yes, you can avoid using custom revivers for ArrayBuffers and implement strict input validation as a temporary measure until the package is updated.
You can visit the devalue package repository on npm or GitHub for more details on its functionality and updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
