GHSA-x5rw-q4pp-hg5g
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
- Severity
- 8.2 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Fix
5.9.3- Upgrade devalue to this version or later
Description
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned stringifyAsync promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.
This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.
Affected versions
npm
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
devalue npm → 5.9.3
- npm
npm install devalue@5.9.3- yarn
yarn add devalue@5.9.3- pnpm
pnpm add devalue@5.9.3
Severity breakdown
CVSS 4.0 8.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- High
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
Weakness
CWE-248: Uncaught Exception
An exception is thrown from a function, but it is not caught.
CWE-755: Improper Handling of Exceptional Conditions
The product does not handle or incorrectly handles an exceptional condition.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-hx4r-w6wj-j8fg devalue: Residual sparse-array CPU amplification in uneval | Medium | Also affects devalue |
| GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval | High | Also affects devalue |
| GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated | Low | Also affects devalue |
| GHSA-r9w8-h9r3-54w4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation | High | Also affects devalue |
| GHSA-4q55-j62x-fr9h devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion | Medium | Also affects devalue |
| GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory | High | Also affects devalue |
| GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input | Medium | Also affects devalue |
| GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization | High | Also affects devalue |
Credits: elliott-with-the-longest-name-on-github
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor