N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-33hq-fvwr-56pm

GHSA-33hq-fvwr-56pm: devalue affected by CPU and memory amplification from sparse arrays

Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse array on the server — which is impossible in every mainstream wire format — and then that sparse array would have to be run through uneval or stringify.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-33hq-fvwr-56pm

GHSA-33hq-fvwr-56pm:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devalue	npm	<= 5.6.2	5.6.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in how the devalue library handles the serialization of sparse arrays in its stringify and uneval functions. The original implementation in both functions iterated through all array indices up to the array's length. This becomes a problem with sparse arrays, which can have a very large length but only a few actual elements. For instance, an array like const arr = []; arr[1000000] = 'value'; has a length of 1,000,001 but only one element. The vulnerable code would loop 1,000,001 times, consuming significant CPU and memory, leading to a Denial of Service (DoS). The patch addresses this by introducing a check to detect if an array is sparse. If it is, a more efficient serialization method is used that only considers the populated indices, thus avoiding the costly iteration over empty slots. The stringify function now uses a special SPARSE encoding, and the uneval function generates an Object.assign(Array(...), ...) expression to reconstruct the sparse array efficiently.

Vulnerable functions

stringify

src/stringify.js

The `stringify` function was vulnerable to a denial-of-service attack. When processing a sparse array (an array with many empty slots), the function would iterate through every single slot up to the array's length. An attacker could provide a very large sparse array (e.g., with an element at index 1,000,000 and nothing else), causing the server to exhaust CPU and memory while iterating through millions of empty slots. The patch fixes this by detecting sparse arrays and using a more efficient serialization strategy that only processes populated indices.

uneval

src/uneval.js

Similar to `stringify`, the `uneval` function was vulnerable to a denial-of-service attack. It used `Array.prototype.map` on the input array, which would iterate over every slot up to the array's `length`. When given a large sparse array, this iteration would lead to excessive CPU and memory consumption, causing a DoS. The patch replaces this inefficient iteration with a mechanism that detects sparse arrays and generates optimized output (`Object.assign(Array(n),{...})`) that avoids iterating over empty slots.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.