{"id":"GHSA-mcm9-63f2-9j32","title":"devalue: Repeated primitive strings cause quadratic expansion in uneval","summary":"devalue: Repeated primitive strings cause quadratic expansion in uneval","severity":"high","cwe":["CWE-400","CWE-409"],"vendor":"devalue","product":"devalue","ecosystem":"npm","affected":["devalue <= 5.9.2"],"patched":["devalue 5.9.3"],"published":"2026-10-01","updated":"2026-10-01","sourceUpdated":"2026-10-01T15:17:30Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-mcm9-63f2-9j32","references":[{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32"},{"url":"https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463"},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"},{"url":"https://github.com/advisories/GHSA-mcm9-63f2-9j32"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-01T15:48:17.830Z","slug":"GHSA-mcm9-63f2-9j32","body":"## Overview\n\nUnder very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.\n\n## Affected packages\n\n- `devalue <= 5.9.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `devalue 5.9.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}