---
id: GHSA-mcm9-63f2-9j32
title: 'devalue: Repeated primitive strings cause quadratic expansion in uneval'
summary: 'devalue: Repeated primitive strings cause quadratic expansion in uneval'
severity: high
cwe:
  - CWE-400
  - CWE-409
vendor: devalue
product: devalue
ecosystem: npm
affected:
  - devalue <= 5.9.2
patched:
  - devalue 5.9.3
published: '2026-10-01'
updated: '2026-10-01'
sourceUpdated: '2026-10-01T15:17:30Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-mcm9-63f2-9j32'
references:
  - url: >-
      https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32
  - url: >-
      https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
  - url: 'https://github.com/sveltejs/devalue/releases/tag/v5.9.3'
  - url: 'https://github.com/advisories/GHSA-mcm9-63f2-9j32'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-01T15:48:17.830Z'
---

## Overview

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.

## Affected packages

- `devalue <= 5.9.2`

## Remediation

Upgrade to a patched release:

- `devalue 5.9.3`