devalue CVE-2026-123562

Exploitation requires that the application (1) calls devalue's stringifyAsync to serialize MULTIPLE promises simultaneously, and (2) allows attacker influence over the timing or failure (rejection) of those asynchronous values so that a later promise can reject before an earlier one settles. The limiting factors are significant: the vendor states exploitation is 'essentially impossible' and that the issue is far more likely to appear as a developer-introduced bug; it also relies on Node.js's default unhandled-rejection-terminates-process behavior (configurable via --unhandled-rejections). Applications that do not serialize multiple promises, or that do not expose promise timing/failure to untrusted input, are not realistically exposed. Only devalue versions >= 5.8.0 and <= 5.9.2 are affected.

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) scores 8.7 (High) driven entirely by availability impact (VA:H), with no confidentiality or integrity impact - this is a pure denial-of-service (process-termination) issue, not data exposure despite the misleading 'Information Disclosure' tag. The decision label is 'this_week' rather than act_now/emergency, consistent with a serious-but-not-urgent DoS. Critically, the vendor's own GHSA advisory states this is 'essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug,' which directly contradicts the AC:L rating in the supplied vector: real exploitation requires an attacker to influence the relative timing and failure ordering of multiple serialized promises, a non-trivial precondition. No CISA KEV listing and no EPSS score were provided, and there is no confirmed working exploit code - only advisory references. Net assessment: a legitimate availability bug worth patching on a normal cadence, but the real-world weaponizability is low and the raw 8.7 overstates practical priority. If an application never passes attacker-influenced async values/timing into stringifyAsync, exposure is effectively nil.

An application uses devalue's stringifyAsync to serialize multiple promises whose resolution timing or failure is derived from untrusted request input. An attacker crafts input causing a later promise to reject before an earlier one settles, producing an internal unhandled rejection that, under Node's default behavior, crashes the process - even though the application correctly awaits and catches the returned promise. No public working exploit code was identified, and the vendor characterizes practical exploitation as 'essentially impossible.'