{"id":"CVE-2026-123563","kind":"vulnerability","aliases":["CVE-2026-123563"],"related":[],"title":"Devalue: crafted input lets a custom reviver exhaust memory","description":"Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.","summary":"Devalue is a JavaScript serialization library, and before version 5.9.3 a custom ArrayBuffer reviver can skip its typed-array allocation checks in the parse function. A small crafted input can make it allocate massive ArrayBuffers, exhausting memory and causing a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devalue","javascript","npm","package","self-hosted"],"not_affected_if":["default-config","trusted-input-only"],"how_to_check":"- `npm ls devalue` to find the installed version in the project and its dependencies\n- Look for custom ArrayBuffer revivers passed to devalue's parse function in your code","fix":"- Devalue: move to `5.9.3` or later","status":"open","published_at":"2026-11-08T02:16:48+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:23:04+00:00","updated_at":"2026-11-08T02:23:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:04Z","model":"claude-haiku-5-5","output":{"fix":"- Devalue: move to `5.9.3` or later","reach":"unknown","title":"Devalue: crafted input lets a custom reviver exhaust memory","impact":"medium","summary":"Devalue is a JavaScript serialization library, and before version 5.9.3 a custom ArrayBuffer reviver can skip its typed-array allocation checks in the parse function. A small crafted input can make it allocate massive ArrayBuffers, exhausting memory and causing a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["javascript","npm","devalue","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"memory exhaustion crashes the process, causing denial of service","analyst_note":"","how_to_check":"- `npm ls devalue` to find the installed version in the project and its dependencies\n- Look for custom ArrayBuffer revivers passed to devalue's parse function in your code","plain_action":"","needs_analyst":false,"not_affected_if":["default-config","trusted-input-only"],"who_is_affected":"Applications that call devalue's parse function with a custom ArrayBuffer reviver on untrusted input are exposed. Projects that use devalue only to serialize trusted data, or that never pass custom revivers, are less likely to be affected. The sources do not say more about which deployments are at highest risk.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000688,"input_tokens":4291,"output_tokens":518,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123563':12A,15A '-2026':11A,14A '5.9.3':32B,69C 'alloc':43B,56B,85C,105C 'allow':76C 'array':42B,84C 'arraybuff':35B,58B,78C,102C,107C 'attack':91C 'bypass':73C 'caus':62B,108C 'check':44B,86C 'contain':70C 'craft':2A,51B,96C 'custom':6A,34B,77C 'cve':10A,13A 'denial':64B,112C 'devalu':1A,16B,23B,67C 'exhaust':8A,59B,110C 'function':48B,90C 'host':22B 'input':3A,52B,97C 'javascript':17B,26B 'let':4A 'librari':28B 'make':54B 'malform':101C 'massiv':57B,106C 'memori':9A,60B,109C 'npm':18B 'packag':19B 'pars':47B,89C 'process':98C 'reviv':7A,36B,79C,103C 'self':21B 'self-host':20B 'serial':27B 'servic':66B,114C 'skip':38B,81C 'small':50B,95C 'suppli':93C 'type':41B,83C 'typed-array':40B,82C 'valid':72C 'version':31B 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Applications that call devalue's parse function with a custom ArrayBuffer reviver on untrusted input are exposed. Projects that use devalue only to serialize trusted data, or that never pass custom revivers, are less likely to be affected. The sources do not say more about which deployments are at highest risk.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devalue","high","javascript","npm","package","selfhosted"],"campaign_type":null,"search_a":"'-123563':12A,15A '-2026':11A,14A 'craft':2A 'custom':6A 'cve':10A,13A 'devalu':1A 'exhaust':8A 'input':3A 'let':4A 'memori':9A 'reviv':7A","search_b":"'5.9.3':32B 'alloc':43B,56B 'array':42B 'arraybuff':35B,58B 'caus':62B 'check':44B 'craft':51B 'custom':34B 'denial':64B 'devalu':16B,23B 'exhaust':59B 'function':48B 'host':22B 'input':52B 'javascript':17B,26B 'librari':28B 'make':54B 'massiv':57B 'memori':60B 'npm':18B 'packag':19B 'pars':47B 'reviv':36B 'self':21B 'self-host':20B 'serial':27B 'servic':66B 'skip':38B 'small':50B 'type':41B 'typed-array':40B 'version':31B","search_c":"'5.9.3':69C 'alloc':85C,105C 'allow':76C 'array':84C 'arraybuff':78C,102C,107C 'attack':91C 'bypass':73C 'caus':108C 'check':86C 'contain':70C 'craft':96C 'custom':77C 'denial':112C 'devalu':67C 'exhaust':110C 'function':90C 'input':97C 'malform':101C 'massiv':106C 'memori':109C 'pars':89C 'process':98C 'reviv':79C,103C 'servic':114C 'skip':81C 'small':95C 'suppli':93C 'type':83C 'typed-array':82C 'valid':72C 'vulner':74C","first_public_at":"2026-09-18T18:40:49+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123563","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123563","severity":null,"published_at":"2026-11-08T02:16:48+00:00","modified_at":"2026-11-08T02:16:48+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99277,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-18T18:40:49+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99278,"url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}