A Node flaw with a CVSS score of 7.5 exposes unrelated process memory via serialized shared buffers, affecting devalue versions between 5.1.0 and 5.9.2. The issue arises when `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view, allowing unrelated memory to be serialized into a response sent to the client. This results in unauthenticated, silent amplification via serialization-side vulnerability in an SSR framework, requiring users to convert Node `Buffer` objects to `Uint8Array` to mitigate. The flaw type is a buffer overflow, with an attack vector of network access and no user interaction required. Business impact includes unauthorized data exposure and potential denial-of-service attacks.
We recommend you to update devalue to version 5.9.3.[/subscribe_to_unlock_form]
A Node flaw with a CVSS score of 7.5 exposes unrelated process memory via serialized shared buffers, affecting devalue versions between 5.1.0 and 5.9.2. The issue arises when `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view, allowing unrelated memory to be serialized into a response sent to the client. This results in unauthenticated, silent amplification via serialization-side vulnerability in an SSR framework, requiring users to convert Node `Buffer` objects to `Uint8Array` to mitigate. The flaw type is a buffer overflow, with an attack vector of network access and no user interaction required. Business impact includes unauthorized data exposure and potential denial-of-service attacks.
We recommend you to update devalue to version 5.9.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]