CVE-2026-123562 · Package
NO FIX YET · SEE WHAT TO DO
devalue versions 5.8.0 before 5.9.3 mishandle promise rejections inside stringifyAsync when several promises are serialized. A later rejection can leave an internal rejection unhandled, even when the caller catches the result, and that can terminate the Node.js process.
first public Sep 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Node.js code that uses devalue's stringifyAsync to serialize multiple asynchronous values, where an attacker can influence the timing or failure of those values. Projects that do not call stringifyAsync or that run only synchronous serialization are likely not affected. Exact exposure depends on whether untrusted input reaches the promise chain.
Not affected if no-untrusted-input, sync-only-usage
Who cares devalue, node.js, sveltekit
npm ls devalue in each project that uses it.5.9.3 or later (fixed version per the sources).devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.