Description
The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| sveltejs | devalue | < 5.6.3 | 5.6.3 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | devalue | < 5.6.3 | 5.6.3 | GHSA-33hq-fvwr-56pm |
References
- GitHub Security Advisory (GHSA-33hq-fvwr-56pm) vendor-advisory
- VulnCheck Advisory: Devalue before 5.6.3 Denial of Service via Sparse Array Serialization third-party-advisory