SB2026092104 - Multiple vulnerabilities in devalue

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092104

SB2026092104 - Multiple vulnerabilities in devalue

Published: September 21, 2026

Security Bulletin ID SB2026092104
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Medium 57% Low 43%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) Input validation error (CVE-ID: N/A)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to create objects with a __proto__ own property.

The vulnerability exists due to improper handling of property-key coercion in the parse function when parsing malformed serialized payloads. A remote attacker can supply a malformed serialized payload to create objects with a __proto__ own property.


2) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of exceptional conditions in stringifyAsync when serializing multiple promises. A remote attacker can cause a later promise to reject before an earlier promise settles to cause a denial of service.


3) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper validation of typed-array allocations in the parse function's custom ArrayBuffer reviver handling when processing input with a malformed ArrayBuffer custom reviver. A local user can provide a small input that causes a massive ArrayBuffer allocation to cause a denial of service.


4) Uncontrolled Memory Allocation (CVE-ID: N/A)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with excessive size value in uneval-generated sparse-array code when evaluating generated code for sparse arrays. A remote attacker can trigger evaluation of generated sparse-array code to cause a denial of service.

Default parse sparse-array construction is not affected.


5) Improper handling of highly compressed data (CVE-ID: N/A)

CWE-ID: CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper handling of data amplification in the uneval function when serializing data previously processed by parse. A local user can provide data containing repeated primitive strings to cause a denial of service.

Exploitation is possible only under very constrained circumstances.


6) Inefficient Algorithmic Complexity (CVE-ID: N/A)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause event-loop blocking.

The vulnerability exists due to inefficient algorithmic complexity in the uneval function when processing attacker-influenced sparse arrays. A remote attacker can supply a sparse array with a large declared length to cause event-loop blocking.

Exploitation is very difficult because attacker-controlled creation of sparse arrays is difficult.


7) Sensitive Information in Resource Not Removed Before Reuse (CVE-ID: CVE-2026-92708)

CWE-ID: CWE-226 - Sensitive Information in Resource Not Removed Before Reuse

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to sensitive information in a resource not removed before reuse in the `stringify` and `uneval` serialization functions when serializing Node `Buffer` objects. A remote attacker can request a server-side rendered page that serializes a Node `Buffer` to disclose sensitive information.

The Node `Buffer` backing store is a process-wide shared pool, and serialization can include unrelated memory from other in-flight requests in the response.


Remediation

Install update from vendor's website.

References