Moderate CPU Amplification Vulnerability in devalue Package Affecting Event Loop Performance
Summary
GHSA-hx4r-w6wj-j8fg: devalue: Residual sparse-array CPU amplification in uneval. Affects devalue versions < 5.9.3. Fixed in 5.9.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The devalue package is a JavaScript library used for serializing and deserializing JavaScript objects. It is particularly useful for handling complex data structures and ensuring that data can be safely transmitted or stored. However, this package has a vulnerability that can lead to performance issues when handling sparse arrays, which are arrays that have gaps in their indices. This vulnerability can cause significant delays in applications that rely on the devalue package for processing data.
Vulnerability Detail
The vulnerability arises from the uneval function within the devalue package, which performs synchronous operations based on the declared length of sparse arrays. If an application passes attacker-controlled sparse values to uneval, it can lead to event-loop blocking, causing the application to become unresponsive. Although the exploitation of this vulnerability is challenging due to the difficulty in creating attacker-controlled sparse arrays, the potential for performance degradation remains a concern for developers using this package.
How To Fix
Latest published version: 6.0.3 as of 23 Oct 2026
npm install devalue@6.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.9.3
This is the first release that contains the fix.
npm install devalue@5.9.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, you can avoid passing sparse arrays to the uneval function. Instead, ensure that all arrays are fully populated before serialization. For example, instead of using a sparse array like this:
const sparseArray = [1, , 3];
use a fully populated array:
const fullArray = [1, 0, 3];
Conclusion
The devalue package has a vulnerability related to the handling of sparse arrays in its uneval function, which can lead to performance issues in applications. It is crucial for developers to update to the latest version to mitigate these risks and ensure optimal performance. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for devalue →
FAQ
The CVSS score of this vulnerability is 6.3, indicating a moderate level of risk.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Sparse arrays are arrays with gaps in their indices, which can lead to inefficient processing in functions like uneval. This can cause performance issues and event-loop blocking.
It is advisable to update to the patched version (5.9.3 or later) to mitigate the risk associated with this vulnerability.
If an immediate update is not possible, implement the workaround by avoiding the use of sparse arrays in your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
