Skip to content

chore(deps): update dependency devalue to ^5.9.4 [security] - #3997

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-devalue-vulnerability
Open

chore(deps): update dependency devalue to ^5.9.4 [security]#3997
renovate[bot] wants to merge 1 commit into
mainfrom
renovate-npm-devalue-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
devalue ^5.8.1 → ^5.9.4 age confidence

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

GHSA-x5rw-q4pp-hg5g

More information

Details

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.

This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: stringify/uneval serialize shared memory

CVE-2026-92708 / GHSA-j22f-vq7h-c4qm

More information

Details

Impact

stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node Buffer the backing store is Node's process-wide shared pool, so serializing a small Buffer copies up to 64 KB of unrelated process memory — including bytes from other in-flight requests — into the output. In an SSR framework (SvelteKit, Nuxt) a public page whose load() returns a 2-byte Buffer, or a small file read with readFileSync, ships another user's request body / Authorization header in its HTML. Unauthenticated, silent, ~43,000× amplification.

This is serialization-side, so the parse/unflatten prototype-pollution and DoS guards do not apply — it fires on every SSR render, not only when parsing untrusted input.

Workarounds

Convert Node Buffer objects to Uint8Array:

payload = {
- buffer
+ buffer: new Uint8Array(buffer)
}

Severity

  • CVSS Score: 7.5 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

GHSA-r9w8-h9r3-54w4

More information

Details

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

GHSA-4q55-j62x-fr9h

More information

Details

This is another instance of GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

GHSA-wf3x-273g-mvxv

More information

Details

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array construction.

You would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for uneval of sending data to the client, the worst that could happen is the browser tab running out of memory.

Severity

  • CVSS Score: 2.3 / 10 (Low)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: Repeated primitive strings cause quadratic expansion in uneval

GHSA-mcm9-63f2-9j32

More information

Details

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.

Severity

  • CVSS Score: 8.2 / 10 (High)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

devalue: Residual sparse-array CPU amplification in uneval

GHSA-hx4r-w6wj-j8fg

More information

Details

uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.

Severity

  • CVSS Score: 6.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

sveltejs/devalue (devalue)

v5.9.4

Compare Source

Patch Changes
  • 067b125: perf: annotate module-level Object.freeze calls as pure so unused operation tables tree-shake

v5.9.3

Compare Source

Patch Changes
  • 6861dbb: fix: avoid scanning sparse array holes in uneval traversal and shared-array population
  • 9ec5130: fix: reject non-string null-prototype object keys in parse and unflatten to prevent bypassing the __proto__ check
  • dae8153: fix: prevent unhandled internal rejections in stringifyAsync when serializing multiple promises
  • 84f6f67: fix: prevent quadratic uneval output expansion for repeated strings and bigints
  • 6861dbb: fix: avoid eager allocation when evaluating sparse arrays emitted by uneval
  • 8f8d78e: fix: validate revived backing buffers before constructing typed arrays
  • 46dc877: fix: serialize only the visible bytes of Node Buffers in stringify, stringifyAsync and uneval, preventing disclosure of unrelated data from their shared allocation pool

v5.9.2

Compare Source

Patch Changes
  • 8b2a456: fix: reject out-of-bounds indices

v5.9.1

Compare Source

Patch Changes
  • 39457ce: fix: uneval emits valid JS for graphs with more than 65534 repeated references
  • 686e379: fix: emit valid JS for Node Buffer in uneval
  • 376b65c: fix: preserve -0 in float typed arrays in uneval

v5.9.0

Compare Source

Minor Changes
  • 07d6a38: feat: export filterArrayIndices, the array-index filtering used by the indicesOf stringify operation, so custom operations can reuse it instead of reimplementing it
  • 07d6a38: feat: add pluggable operations option to parse/unflatten, allowing customization of how values are constructed while reviving (e.g. cross-realm or foreign-runtime revival)
  • 5b53532: feat: add pluggable operations option to stringify/stringifyAsync, allowing customization of how values are introspected during serialization (e.g. side-effect-free or foreign-runtime serialization)

v5.8.2

Compare Source

Patch Changes
  • 48cc81f: fix: serialize DataView subviews with the correct byte offset and length
  • cd6da94: fix: resolve circular references through custom revivers when payload is already hydrated
  • 29a3382: fix: uneval now produces valid output for a repeated empty Map or Set
  • 8c0db06: fix: serialize Temporal values referenced more than once in uneval
  • 3770846: fix: emit valid JS for BigInt64Array and BigUint64Array in uneval
  • 756265a: fix: preserve shared-reference identity for Map keys in uneval
  • faa8a05: fix: emit uneval reconstructions before the statements that reference them
  • 06129ad: fix: do not grow sparse arrays by one slot in uneval

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate Bot added the dependencies Pull requests that update a dependency label Oct 25, 2026
@netlify

netlify Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

✅ Deploy Preview for brilliant-pasca-3e80ec canceled.

Name Link
🔨 Latest commit 4f517cb
🔍 Latest deploy log https://app.netlify.com/projects/brilliant-pasca-3e80ec/deploys/6ae1e27612d8f92a371e8776

@github-actions

github-actions Bot commented Oct 25, 2026 •
edited
Loading

Copy link
Copy Markdown

🚀 Performance Test Results

Test Configuration:

  • VUs: 4
  • Duration: 1m0s

Test Metrics:

  • Requests/s: 61.83
  • Iterations/s: 20.61
  • Failed Requests: 0.00% (0 of 3718)
📜 Logs 

> performance@1.0.0 run-tests:testenv /home/runner/work/rafiki/rafiki/test/performance
> ./scripts/run-tests.sh -e test -k -q --vus 4 --duration 1m

Cloud Nine GraphQL API is up: http://localhost:3101/graphql
Cloud Nine Wallet Address is up: http://localhost:3100/
Happy Life Bank Address is up: http://localhost:4100/
cloud-nine-wallet-test-backend already set
cloud-nine-wallet-test-auth already set
happy-life-bank-test-backend already set
happy-life-bank-test-auth already set
     data_received..................: 1.3 MB 22 kB/s
     data_sent......................: 2.9 MB 48 kB/s
     http_req_blocked...............: avg=6.65µs  min=1.62µs   med=4.82µs   max=633.83µs p(90)=6.26µs   p(95)=7.09µs  
     http_req_connecting............: avg=408ns   min=0s       med=0s       max=530.75µs p(90)=0s       p(95)=0s      
     http_req_duration..............: avg=64.09ms min=6.09ms   med=51.4ms   max=396.2ms  p(90)=107.61ms p(95)=120.72ms
       { expected_response:true }...: avg=64.09ms min=6.09ms   med=51.4ms   max=396.2ms  p(90)=107.61ms p(95)=120.72ms
     http_req_failed................: 0.00%  ✓ 0         ✗ 3718
     http_req_receiving.............: avg=90.09µs min=19.95µs  med=78.98µs  max=2.97ms   p(90)=115.61µs p(95)=164.43µs
     http_req_sending...............: avg=34.15µs min=7.78µs   med=23.03µs  max=3ms      p(90)=37.49µs  p(95)=55.34µs 
     http_req_tls_handshaking.......: avg=0s      min=0s       med=0s       max=0s       p(90)=0s       p(95)=0s      
     http_req_waiting...............: avg=63.96ms min=5.94ms   med=51.26ms  max=396.1ms  p(90)=107.53ms p(95)=120.65ms
     http_reqs......................: 3718   61.831728/s
     iteration_duration.............: avg=193.9ms min=127.45ms med=184.29ms max=762.91ms p(90)=237.71ms p(95)=267.55ms
     iterations.....................: 1239   20.605033/s
     vus............................: 4      min=4       max=4 
     vus_max........................: 4      min=4       max=4

@renovate
renovate Bot force-pushed the renovate-npm-devalue-vulnerability branch from 9e2fb6c to 4f517cb Compare October 28, 2026 11:54

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants