{"action":"Upgrade devalue to 5.9.3 or later.","affected":[{"fixed":"5.9.3","introduced":"1.0.0"}],"component":"devalue","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["5.9.3"],"ghsa_id":"GHSA-wf3x-273g-mvxv","id":"tcs_01M5KGETBF2CFXAACE3BBGC6JR","modified_at":"2026-10-01T15:30:13.280047533Z","published_at":"2026-10-01T15:17:13Z","references":["https://osv.dev/vulnerability/GHSA-wf3x-273g-mvxv","https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv","https://github.com/sveltejs/devalue/commit/6861dbbb7e548849e48bce718e88747a298f7250","https://github.com/sveltejs/devalue","https://github.com/sveltejs/devalue/releases/tag/v5.9.3"],"severity":{"label":"low"},"sources":[{"source":"osv","source_id":"GHSA-wf3x-273g-mvxv","url":"https://osv.dev/vulnerability/GHSA-wf3x-273g-mvxv"}],"summary":"devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated"}