{"id":"CVE-2026-92708","aliases":["GHSA-j22f-vq7h-c4qm"],"url":"https://o3.security/vulnerability/CVE-2026-92708","summary":"devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers","details":"### Impact\n\n`stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. In the case of a Node `Buffer` object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node `Buffer` the backing store is Node's **process-wide shared pool**, so serializing a small `Buffer` copies up to 64 KB of unrelated process memory — including bytes from other in-flight requests — into the output. In an SSR framework (SvelteKit, Nuxt) a public page whose `load()` returns a 2-byte `Buffer`, or a small file read with `readFileSync`, ships another user's request body / `Authorization` header in its HTML. Unauthenticated, silent, ~43,000× amplification.\n\nThis is serialization-side, so the `parse`/`unflatten` prototype-pollution and DoS guards do not apply — it fires on every SSR render, not only when parsing untrusted input.\n\n### Workarounds\n\nConvert Node `Buffer` objects to `Uint8Array`:\n\n```diff\npayload = {\n- buffer\n+ buffer: new Uint8Array(buffer)\n}\n```","published":"2026-09-18T19:54:28.335Z","modified":"2026-10-28T02:30:24.367707820Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.9.3"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266","label":"sveltejs/devalue@46dc877"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92708.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92708"},{"type":"FIX","url":"https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:24.367707820Z"}}