Devalue 5.8.0 Before 5.9.3 Denial Of Service Via Stringifyasync Unhandled Rejection

Back www.vulncheck.com

Devalue 5.8.0 Before 5.9.3 Denial Of Service Via Stringifyasync Unhandled Rejection

www.vulncheck.com • November 8, 2026

Share: View original

Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

devalue >= 5.8.0, = 5.8.0, < 5.9.3

CWE-248 Uncaught Exception

GitHub Security Advisory (GHSA-x5rw-q4pp-hg5g)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Denial of Service Vulnerabilities in Devalue Before 5.9.3 Three distinct denial of service vulnerabilities have been identified in the Devalue software, affecting versions 5.8.0 to 5.9.2. The vulnerabilities include a denial of service via stringifyAsync unhandled rejection (CWE-248), quadratic expansion via uneval, and a typed array allocation validation bypass via parse. These issues could allow attackers to disrupt service availability. No specific exploitation in the wild has been reported yet, but the vulnerabilities are considered serious. Users are advised to upgrade to version 5.9.3 or later, which addresses these vulnerabilities. The vulnerabilities were disclosed on November 8, 2026, and are detailed in GitHub Security Advisories. 46

Extracted Entities

Attack Types (1)

Denial of Service

Platforms (2)