Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.2

GitHub Actions devalue can allocate huge memory blocks

published 1 month ago
Summary

The devalue tool used in GitHub Actions can be tricked into creating extremely large memory areas from tiny inputs when a specially crafted custom handler is used. This can cause the system to run out of memory or become unresponsive. Update to the latest version of devalue or stop using custom array handlers until the fix is applied.

What to do
  • Update GitHub Actions devalue to version 5.9.3.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions devalue <= 5.9.2
Fix: upgrade to 5.9.3
Original advisory text
devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation
Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
8.2 High
Type
CWE-789Memory Allocation with Excessive Size Value
CWE-843Type Confusion
Timeline
Published1 Oct 2026
Updated17 Oct 2026
First seen17 Oct 2026
Sources
GHSA-r9w8-h9r3-54w4 · GHSA
Track software like this
Free during beta