---
id: GHSA-r9w8-h9r3-54w4
title: >-
  devalue: Custom ArrayBuffer revivers can bypass typed-array allocation
  validation
summary: >-
  devalue: Custom ArrayBuffer revivers can bypass typed-array allocation
  validation
severity: high
cwe:
  - CWE-789
  - CWE-843
vendor: devalue
product: devalue
ecosystem: npm
affected:
  - devalue <= 5.9.2
patched:
  - devalue 5.9.3
published: '2026-10-01'
updated: '2026-10-17'
sourceUpdated: '2026-10-17T05:04:12Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-r9w8-h9r3-54w4'
references:
  - url: >-
      https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
  - url: >-
      https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99
  - url: 'https://github.com/sveltejs/devalue/releases/tag/v5.9.3'
  - url: 'https://github.com/advisories/GHSA-r9w8-h9r3-54w4'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-17T06:00:41.404Z'
---

## Overview

Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.

## Affected packages

- `devalue <= 5.9.2`

## Remediation

Upgrade to a patched release:

- `devalue 5.9.3`