Summary
devalue: Repeated primitive strings cause quadratic expansion in uneval
Advisory details
Under very constrained circumstances, data that was parsed and then passed to uneval could turn a small payload into a very large serialized string.
References
Related vulnerabilities
All Supply chain →- HIGHCVE-2026-91979
Vikunja: Denial of service via decompression bomb in the data import
- HIGHCVE-2026-107227
AsyncHttpClient: Unbounded WebSocket permessage-deflate decompression enables a decompression-bomb denial of service when compression is enabled
- HIGHGHSA-chx6-46f5-w4vp
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
- HIGHCVE-2026-81875
HAPI FHIR: SHCParser unbounded DEFLATE decompression causes denial of service
- HIGHCVE-2026-85721
AsyncHttpClient's unbounded HTTP/1.1 response decompression enables a decompression-bomb denial of service
- MEDIUMCVE-2026-95838
containerd: Unpack DoS via repeated opaque whiteouts