{"id":"GHSA-r9w8-h9r3-54w4","title":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","summary":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","severity":"high","cwe":["CWE-789","CWE-843"],"vendor":"devalue","product":"devalue","ecosystem":"npm","affected":["devalue <= 5.9.2"],"patched":["devalue 5.9.3"],"published":"2026-10-01","updated":"2026-10-17","sourceUpdated":"2026-10-17T05:04:12Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-r9w8-h9r3-54w4","references":[{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4"},{"url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99"},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"},{"url":"https://github.com/advisories/GHSA-r9w8-h9r3-54w4"}],"tags":["ghsa","npm"],"ingestedAt":"2026-10-17T06:00:41.404Z","slug":"GHSA-r9w8-h9r3-54w4","body":"## Overview\n\nUnder very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.\n\n## Affected packages\n\n- `devalue <= 5.9.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `devalue 5.9.3`","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}