HIGH

GHSA-r9w8-h9r3-54w4

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Quick fix

GHSA-r9w8-h9r3-54w4 — devalue: upgrade to the fixed version with the command below.

npm install devalue@5.9.3

Details

Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/devalue

Introduced in: 0Fixed in: 5.9.3

Fixnpm install devalue@5.9.3

References

https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4[WEB]
https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99[WEB]
https://github.com/sveltejs/devalue[PACKAGE]
https://github.com/sveltejs/devalue/releases/tag/v5.9.3[WEB]