AIKIDO-2026-256877
devalue is vulnerable to Denial of Service (DoS)
37
Low Risk
This Affects:
devalueTL;DR
stringifyAsync stores promises and awaits them one at a time. A later promise can reject before an earlier one settles, or traversal can throw before those promises are awaited, leaving an internal rejected promise unhandled even when the caller catches the returned promise. Under Node's default unhandled-rejection behavior that can terminate the process. The fix attaches a catch handler to each internal promise while still propagating the original error to the caller.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serialize multiple promises with stringifyAsync.
Background info
devalue is vulnerable to Denial of Service (DoS) in versions 5.8.0 - 5.9.2.
How to fix this
Upgrade the devalue library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.