| Package | Affected versions | Patched versions |
|---|---|---|
| devalue | < 5.6.3 | 5.6.3 |
Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through uneval or stringify.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free