{"id":"GHSA-mcm9-63f2-9j32","aliases":[],"url":"https://o3.security/vulnerability/GHSA-mcm9-63f2-9j32","summary":"devalue: Repeated primitive strings cause quadratic expansion in uneval","details":"Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.","published":"2026-10-01T15:17:29Z","modified":"2026-10-01T15:30:12.676095253Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.9.3"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463","label":"sveltejs/devalue@84f6f67"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-01T15:30:12.676095253Z"}}