devalue EUVD-2026-119448

Exploitation requires the integrating application to use devalue's parse() with a custom ArrayBuffer reviver that is malformed; per the GHSA advisory this happens only 'under very specific circumstances.' That custom-reviver configuration is the concrete prerequisite and is non-default - applications relying on devalue's built-in parsing without a custom ArrayBuffer reviver are not exposed. The limiting factor is therefore this specific, application-supplied configuration rather than attacker-controlled input alone; where present, no authentication (PR:N) or user interaction (UI:N) is needed and the untrusted input reaches parse() over the network. Impact is confined to availability (memory-exhaustion DoS); no confidentiality or integrity effect.

The input signals are genuinely mixed, and the raw CVSS 4.0 base score of 8.7 (HIGH) overstates everyday risk for most deployments. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H is network-reachable, unauthenticated, no user interaction, with availability-only impact (VA:H; confidentiality and integrity untouched) - consistent with a memory-exhaustion denial of service (CWE-789, plus CWE-843 type confusion per the GHSA). However, the authoritative GHSA advisory states this occurs only 'under very specific circumstances' and 'required a malformed ArrayBuffer custom reviver,' which means the condition is supplied by the integrating application, not the attacker - so the CVSS AT:N (no attack requirements) understates a real precondition that most apps will not meet. No EPSS score was provided, there is no CISA KEV listing, and no PoC or exploit code is referenced - only the GHSA and VulnCheck advisories. The vuln.today decision label is 'this_week,' a patch-promptly tier rather than act_now/emergency. Net: this is a patch-this-week availability bug whose practical exploitability is gated by a non-default custom-reviver configuration, not a high-CVSS issue that translates to broad, immediate real-world risk. Note the discrepancy explicitly: CVSS marks AT:N/AC:L while the advisory describes 'very specific circumstances' requiring a malformed custom reviver - treat the base score as an upper bound and verify your own reviver usage.

An application uses devalue's parse() with a custom, malformed ArrayBuffer reviver to deserialize untrusted input over the network. An attacker sends a very small crafted payload that bypasses the typed-array allocation validation, causing the process to allocate a massive ArrayBuffer and exhaust memory, crashing or hanging the service. No public exploit identified at time of analysis; exploitation requires no authentication (PR:N) but hinges on the vulnerable custom-reviver configuration being present.