| Package | Affected versions | Patched versions |
|---|---|---|
| devalue | < 5.9.3 | 5.9.3 |
uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free