Description
Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | devalue | 1.0.0 – < 5.9.3 | 5.9.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devalue | >= 1.0.0, < 5.9.3 | 5.9.3 | GHSA-wf3x-273g-mvxv |
References
- GitHub Security Advisory (GHSA-wf3x-273g-mvxv) vendor-advisory
- VulnCheck Advisory: Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays third-party-advisory