Because Node.js utilizes a shared pool for Buffer memory, this vulnerability allows for the leakage of up to 64 KB of unrelated process memory into serialized output. In the context of Server-Side Rendering (SSR) frameworks such as SvelteKit or Nuxt, this behavior can be exploited by an unauthenticated party to extract sensitive data belonging to other users. This includes bytes from concurrent requests, such as HTTP request bodies or Authorization headers, which are subsequently embedded into server-rendered HTML. Unlike other vulnerabilities in the library, this issue occurs during serialization and is not mitigated by existing prototype pollution or Denial of Service guards, potentially impacting every SSR render involving Buffer objects.

Impact

The vulnerability poses a severe risk of data exfiltration in web applications utilizing 'devalue' for server-side state serialization. By repeatedly triggering server-side renders that include small Buffers, an attacker can harvest sensitive data from the application's process memory. This exposure includes authentication tokens, user-specific request data, and other sensitive information from concurrent traffic. Successful exploitation leads to unauthorized data access and potential account takeover or business logic compromise.

Recommendation

Prioritize remediation for all applications using 'devalue' for SSR state handling.

• Upgrade to a version of 'devalue' that addresses the memory serialization behavior.
• If an immediate upgrade is unavailable, manually convert all Node.js Buffer objects to Uint8Array instances before passing them to 'devalue.stringify()' or 'devalue.uneval()' as a temporary mitigation.
• Audit SSR logic in SvelteKit and Nuxt applications to identify instances where Buffer objects are included in serialized state.