GHSA-r9w8-h9r3-54w4
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
Description
Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
devalue npm → 5.9.3
- npm
npm install devalue@5.9.3- yarn
yarn add devalue@5.9.3- pnpm
pnpm add devalue@5.9.3
Severity breakdown
CVSS 4.0 8.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-789: Memory Allocation with Excessive Size Value
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
How to prevent it
- Implementation, Architecture and Design: Perform adequate input validation against any value that influences the amount of memory that is allocated. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run your program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hx4r-w6wj-j8fg devalue: Residual sparse-array CPU amplification in uneval | Medium | Also affects devalue |
| GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval | High | Also affects devalue |
| GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated | Low | Also affects devalue |
| GHSA-x5rw-q4pp-hg5g devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise | High | Also affects devalue |
| GHSA-4q55-j62x-fr9h devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion | Medium | Also affects devalue |
| GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory | High | Also affects devalue |
| GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input | Medium | Also affects devalue |
| GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization | High | Also affects devalue |
Credits: elliott-with-the-longest-name-on-github
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor