Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

GitHub Actions devalue can cause server slowdown

published 1 month ago

Summary

The devalue library used in GitHub Actions has a function that can be forced to do a lot of extra work when it receives a specially crafted array, which can pause other tasks and make the service slower. Exploiting this requires very specific conditions, so it is hard to attack, but the slowdown could affect your workflows. Upgrade to the latest version of devalue or stop using it in your Actions to eliminate the risk.

What to do

Update GitHub Actions devalue to version 5.9.3.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	devalue	< 5.9.3 Fix: upgrade to 5.9.3

Original advisory text

devalue: Residual sparse-array CPU amplification in uneval

`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.3 High

Type

CWE-400Uncontrolled Resource Consumption

CWE-407Inefficient Algorithmic Complexity

Timeline

Published1 Oct 2026

Updated1 Oct 2026

First seen1 Oct 2026

Sources

GHSA-hx4r-w6wj-j8fg · OSV

Track software like this

Free during beta