Description
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | devalue | < 5.9.3 | 5.9.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devalue | < 5.9.3 | 5.9.3 | GHSA-mcm9-63f2-9j32 |
References
- GitHub Security Advisory (GHSA-mcm9-63f2-9j32) vendor-advisory
- VulnCheck Advisory: Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval third-party-advisory