{"action":"Upgrade devalue to 5.6.3 or later.","affected":[{"fixed":"5.6.3","introduced":"0"}],"component":"devalue","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.6.3"],"ghsa_id":"GHSA-33hq-fvwr-56pm","id":"tcs_01M5KEVRYTQ5J169RXQVMMM9DX","modified_at":"2026-02-22T23:20:56.552579Z","published_at":"2026-02-19T20:29:30Z","references":["https://osv.dev/vulnerability/GHSA-33hq-fvwr-56pm","https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm","https://github.com/sveltejs/devalue/commit/819f1ac7475ab37547645cfb09bf2f678a799cf0","https://github.com/sveltejs/devalue","https://github.com/sveltejs/devalue/releases/tag/v5.6.3"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-33hq-fvwr-56pm","url":"https://osv.dev/vulnerability/GHSA-33hq-fvwr-56pm"}],"summary":"devalue affected by CPU and memory amplification from sparse arrays"}