{"id":"GHSA-r9w8-h9r3-54w4","summary":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","details":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","modified":"2026-10-01T15:30:13.282353385Z","published":"2026-10-01T15:15:56Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-10-01T15:15:56Z","nvd_published_at":null,"cwe_ids":["CWE-789","CWE-843"],"severity":"HIGH"},"references":[{"type":"WEB","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"}],"affected":[{"package":{"name":"devalue","ecosystem":"npm","purl":"pkg:npm/devalue"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.3"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-r9w8-h9r3-54w4/GHSA-r9w8-h9r3-54w4.json","last_known_affected_version_range":"\u003c= 5.9.2"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}