GHSA-r9w8-h9r3-54w4: devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

October 1, 2026 (updated October 17, 2026)

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.

References

github.com/advisories/GHSA-r9w8-h9r3-54w4
github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99
github.com/sveltejs/devalue/releases/tag/v5.9.3
github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4

Code Behaviors & Features

Detect and mitigate GHSA-r9w8-h9r3-54w4 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →