Devalue npm Package Sparse Array DoS via Uneval

Executive Summary

The devalue npm package before version 5.6.3 has a flaw where serializing sparse arrays using uneval or stringify consumes excessive CPU and memory. This can cause a denial of service if an attacker creates a sparse array on the server and triggers serialization.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the devalue package using 'npm list devalue'. If the version is below 5.6.3, the system is vulnerable. Monitor CPU and memory usage during serialization operations involving sparse arrays.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to crash your server by causing high CPU and memory usage during serialization of sparse arrays. This leads to system outages and degraded performance.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the devalue package to version 5.6.3 or later using 'npm install devalue@5.6.3'. Avoid processing untrusted sparse arrays in serialization functions like uneval or stringify.

Useful 0 Not Useful 0