{"action":"Upgrade devalue to 5.9.3 or later.","affected":[{"fixed":"5.9.3","introduced":"0"}],"component":"devalue","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.9.3"],"ghsa_id":"GHSA-hx4r-w6wj-j8fg","id":"tcs_01M5KFWCVKJDTKWTE85737DPYQ","modified_at":"2026-10-01T15:30:12.679856219Z","published_at":"2026-10-01T15:17:42Z","references":["https://osv.dev/vulnerability/GHSA-hx4r-w6wj-j8fg","https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg","https://github.com/sveltejs/devalue/commit/6861dbbb7e548849e48bce718e88747a298f7250","https://github.com/sveltejs/devalue","https://github.com/sveltejs/devalue/releases/tag/v5.9.3"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-hx4r-w6wj-j8fg","url":"https://osv.dev/vulnerability/GHSA-hx4r-w6wj-j8fg"}],"summary":"devalue: Residual sparse-array CPU amplification in uneval"}