MEDIUMCVSS 6.3
GHSA-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
Summary
`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | devalue | — | 5.9.3 |
Remediation: Upgrade to 5.9.3 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.