GHSA-x5rw-q4pp-hg5g

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

Published

2026-10-01

Modified

2026-10-01

Sources

github-advisory

Summary

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed. This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.

Affected packages

Remediation: Upgrade to 5.9.3 or later.

References

• https://github.com/advisories/GHSA-x5rw-q4pp-hg5g