Live › vulnerability › GHSA-r9w8-h9r3-54w4
Go to dashboarddevalue is a JavaScript library for serializing and parsing data, and versions up to 5.9.2 let a crafted small input make parse allocate very large ArrayBuffers when a custom ArrayBuffer reviver is used. An attacker who can supply the input can exhaust memory and crash the process (denial of service).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| devalue | npm | <= 5.9.2 | 5.9.3 |
npm ls devalue to find installed versions and check whether any is 5.9.2 or lower5.9.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.
This page as .md · .json · in your agent: get_signal("GHSA-r9w8-h9r3-54w4")
GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.