HIGHCVSS 8.2
GHSA-mcm9-63f2-9j32
devalue: Repeated primitive strings cause quadratic expansion in uneval
Summary
Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| npm | devalue | — | 5.9.3 |
Remediation: Upgrade to 5.9.3 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.