Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
The devalue npm package, versions 5.8.0 up to but not including 5.9.3, can leave an internal promise unhandled when stringifyAsync serializes several promises and a later one rejects before an earlier one settles, even though the caller catches the returned promise. Under Node's default unhandled-rejection behavior this can terminate the process, and the source says applications whose asynchronous failures or timing can be influenced by requests are potentially exposed, though it also calls exploitation essentially impossible. Upgrade to devalue 5.9.3, the fixed version.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| Not published | None | 4.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | GitHub Advisory Database |
- CISA KEV Not listed.
- EPSS No score.
Timeline
- 31 Oct 2026, 13:34 UTC First seen by agentprime
- 31 Oct 2026, 13:34 UTC Confirmed by OSV