Summary
devalue: Residual sparse-array CPU amplification in uneval
Advisory details
uneval performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to uneval can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.
References
Related vulnerabilities
All Supply chain →- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts
- MEDIUMCVE-2026-107287
Pydantic AI: Excessive resource use when local web fetching converts nested HTML
- MEDIUMCVE-2026-104844
PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
- HIGHCVE-2026-102999
pypdf: Possible long runtimes with large amount of embedded files
- HIGHCVE-2026-102997
pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)
- HIGHCVE-2026-102994
pypdf: Possible long runtimes/large memory usage when parsing indirect objects