MEDIUM6.3
GHSA-hx4r-w6wj-j8fg
devalue: Residual sparse-array CPU amplification in uneval
Quick fix
GHSA-hx4r-w6wj-j8fg — devalue: upgrade to the fixed version with the command below.
npm install devalue@5.9.3Details
`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
Are you affected?
Enter the version of the package you're using.