CVE-2026-123563 · Package
NO FIX YET · SEE WHAT TO DO
Devalue is a JavaScript serialization library, and before version 5.9.3 a custom ArrayBuffer reviver can skip its typed-array allocation checks in the parse function. A small crafted input can make it allocate massive ArrayBuffers, exhausting memory and causing a denial of service.
first public Sep 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that call devalue's parse function with a custom ArrayBuffer reviver on untrusted input are exposed. Projects that use devalue only to serialize trusted data, or that never pass custom revivers, are less likely to be affected. The sources do not say more about which deployments are at highest risk.
Not affected if default-config, trusted-input-only
Who cares devalue, javascript, npm, self-hosted
npm ls devalue to find the installed version in the project and its dependencies5.9.3 or laterDevalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.