highVulnerability
GHSA-mcm9-63f2-9j32
Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.
Properties
- ghsa_id
- GHSA-mcm9-63f2-9j32
- summary
- devalue: Repeated primitive strings cause quadratic expansion in uneval
- severity
- high
- last_source
- GitHub Advisory Database
- cve_id
- GHSA-mcm9-63f2-9j32
- signal_observed_at
- 2026-10-01T19:14:01+00:00
- is_ghsa_only
- true
- retrieved_at
- 2026-10-01T19:14:01+00:00
- ghsa_published
- 2026-10-01T15:17:29Z
- source_url
- https://github.com/advisories/GHSA-mcm9-63f2-9j32
- ghsa_updated
- 2026-10-01T15:17:30Z
Related Entities (5)
HAS_WEAKNESS (2)
→[Weakness]Uncontrolled Resource Consumption
→[Weakness]Improper Handling of Highly Compressed Data (Data Amplification)
REPORTED_BY (1)
→[Source]GitHub Advisory Database
VULNERABLE_TO (1)
←[Software]npm/devalue
AFFECTS (1)
→[Software]npm/devalue
Explore deeper with Ninja Signal's threat intelligence graph