GHSA-mcm9-63f2-9j32: devalue: Repeated primitive strings cause quadratic expansion in uneval

October 1, 2026

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.

References

github.com/advisories/GHSA-mcm9-63f2-9j32
github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
github.com/sveltejs/devalue/releases/tag/v5.9.3
github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32

Code Behaviors & Features

Detect and mitigate GHSA-mcm9-63f2-9j32 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →