{"id":"GHSA-r9w8-h9r3-54w4","aliases":[],"url":"https://o3.security/vulnerability/GHSA-r9w8-h9r3-54w4","summary":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","details":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","published":"2026-10-01T15:15:56Z","modified":"2026-10-01T15:30:13.282353385Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.9.3"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99","label":"sveltejs/devalue@8f8d78e"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-01T15:30:13.282353385Z"}}