{"id":"GHSA-r9w8-h9r3-54w4","kind":"vulnerability","aliases":["GHSA-r9w8-h9r3-54w4"],"related":[],"title":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","description":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","summary":"devalue is a JavaScript library for serializing and parsing data, and versions up to 5.9.2 let a crafted small input make parse allocate very large ArrayBuffers when a custom ArrayBuffer reviver is used. An attacker who can supply the input can exhaust memory and crash the process (denial of service).","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"devalue","fixed":["5.9.3"],"affected":"<= 5.9.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-789","cwe-843","javascript","node.js","npm","package","sveltekit"],"not_affected_if":["no-custom-arraybuffer-reviver","no-untrusted-input-to-parse","version-5.9.3-or-later"],"how_to_check":"Run npm ls devalue to find installed versions and check whether any is 5.9.2 or lower.\nCheck whether code calls devalue.parse with a custom reviver that handles ArrayBuffer.","fix":"Upgrade devalue to 5.9.3 or later.\nRebuild and redeploy after the upgrade.","status":"open","published_at":"2026-10-01T15:15:56+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","triaged_at":"2026-10-23T20:20:15+00:00","updated_at":"2026-10-23T20:20:15+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-23T20:20:15Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade devalue to 5.9.3 or later.\nRebuild and redeploy after the upgrade.","summary":"devalue is a JavaScript library for serializing and parsing data, and versions up to 5.9.2 let a crafted small input make parse allocate very large ArrayBuffers when a custom ArrayBuffer reviver is used. An attacker who can supply the input can exhaust memory and crash the process (denial of service).","category":"package","who_cares":["npm","javascript","node.js","sveltekit"],"confidence":0.7,"analyst_note":"","how_to_check":"Run npm ls devalue to find installed versions and check whether any is 5.9.2 or lower.\nCheck whether code calls devalue.parse with a custom reviver that handles ArrayBuffer.\nunknown","needs_analyst":false,"not_affected_if":["version-5.9.3-or-later","no-custom-arraybuffer-reviver","no-untrusted-input-to-parse"],"severity_if_unknown":"high"},"cost_usd":0.000378,"input_tokens":2009,"output_tokens":354,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-789':24B '-843':26B '5.9.2':46B '54w4':16A,21A 'alloc':10A,54B 'array':9A 'arraybuff':3A,57B,61B,90C,99C 'attack':66B 'bypass':6A 'circumst':85C 'could':87C 'craft':49B 'crash':76B 'creat':88C 'custom':2A,60B,100C 'cwe':23B,25B 'data':41B 'denial':79B 'devalu':1A,32B 'devalue':22A 'exhaust':73B 'ghsa':13A,18A 'ghsa-r9w8-h9r3-54w4':12A,17A 'h9r3':15A,20A 'input':51B,71B,94C 'javascript':27B,35B 'larg':56B 'let':47B 'librari':36B 'make':52B 'malform':98C 'massiv':89C 'memori':74B 'node.js':28B 'npm':29B 'packag':30B 'pars':40B,53B,86C 'process':78B 'r9w8':14A,19A 'requir':96C 'reviv':4A,62B,101C 'serial':38B 'servic':81B 'small':50B,93C 'specif':84C 'suppli':69B 'sveltekit':31B 'type':8A 'typed-array':7A 'use':64B 'valid':11A 'version':43B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-01T15:15:56+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-r9w8-h9r3-54w4","url":"https://github.com/advisories/GHSA-r9w8-h9r3-54w4","severity":"high","published_at":"2026-10-01T15:15:56+00:00","modified_at":"2026-10-17T05:04:12+00:00","first_seen_at":"2026-10-23T19:11:32+00:00","fetched_at":"2026-10-23T19:11:32+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}