GHSA-mcm9-63f2-9j32: devalue: Repeated primitive strings cause quadratic expansion in uneval

October 1, 2026

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.

References

github.com/advisories/GHSA-mcm9-63f2-9j32
github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
github.com/sveltejs/devalue/releases/tag/v5.9.3
github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32

Code Behaviors & Features

Detect and mitigate GHSA-mcm9-63f2-9j32 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →