Skip to content
Threat Feed
Subscribe

Product

Devalue (<= 5.9.2)

1 brief RSS
medium advisory

Uncontrolled Resource Consumption in devalue Serialization

The devalue package for Node.js is vulnerable to a denial-of-service attack where specially crafted input causes quadratic string expansion during the serialization process, leading to memory and CPU exhaustion.

devalue denial-of-service npm supply-chain
1t