What is GHSA-r9w8-h9r3-54w4?

GHSA-r9w8-h9r3-54w4 is a security advisory published by GitHub Security Advisories with High severity. devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Why does GHSA-r9w8-h9r3-54w4 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-r9w8-h9r3-54w4?

GHSA-r9w8-h9r3-54w4 affects 1 product, including: npm/devalue:\u003c= 5.9.2.

GHSA-r9w8-h9r3-54w4HighDisclosed before NVD

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

Vendor

GitHub Security Advisories

Published

October 1, 2026

Last Modified

October 17, 2026

📋 Description

Under very specific circumstances, parse could create massive ArrayBuffers with very small input. This required a malformed ArrayBuffer custom reviver.

🎯 Affected products1

npm/devalue:<= 5.9.2

🔗 References (4)

https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99
https://github.com/sveltejs/devalue/releases/tag/v5.9.3
https://github.com/advisories/GHSA-r9w8-h9r3-54w4