What is GHSA-mcm9-63f2-9j32?

GHSA-mcm9-63f2-9j32 is a security advisory published by GitHub Security Advisories with High severity. devalue: Repeated primitive strings cause quadratic expansion in uneval

Why does GHSA-mcm9-63f2-9j32 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-mcm9-63f2-9j32?

GHSA-mcm9-63f2-9j32 affects 1 product, including: npm/devalue:\u003c= 5.9.2.

GHSA-mcm9-63f2-9j32HighDisclosed before NVD

devalue: Repeated primitive strings cause quadratic expansion in uneval

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 1, 2026

📋 Description

Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.

🎯 Affected products1

npm/devalue:<= 5.9.2

🔗 References (4)

https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32
https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
https://github.com/sveltejs/devalue/releases/tag/v5.9.3
https://github.com/advisories/GHSA-mcm9-63f2-9j32