Product
The devalue library improperly serializes Node.js Buffer objects, exposing up to 64 KB of process-wide memory to end users in SSR environments via CVE-2026-92708.