{ "@id": "urn:uuid:dbf0a94e-e10a-4a67-b86e-1cfa1462f61b", "role": "Document Creator", "author": "https://tuxcare.com", "version": 12, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-08T02:05:52.851547+00:00", "statements": [ { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-57820 does not affect version 2.0.1 of devalue. Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does not contain the vulnerable code path. This version only provides serialization/stringification functionality and lacks the parsing/unflatten functionality that contains the vulnerabilities addressed in CVE-2025-57820. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-57820" }, "impact_statement": "Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does not contain the vulnerable code path. This version only provides serialization/stringification functionality and lacks the parsing/unflatten functionality that contains the vulnerabilities addressed in CVE-2025-57820. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:51:00.045371+00:00", "status_notes": "Vulnerability CVE-2026-123561 does not affect version 2.0.1 of devalue. not_affected \u2014 devalue 2.0.1-tuxcare.5 contains only the serializer (default export `devalue`) in src/index.ts. It has no parse/unflatten deserializer, which first appeared in devalue 4.0.0. CVE-2026-123561 concerns key coercion bypassing parse's __proto__ rejection, so the affected code is absent. The serializer also rejects `__proto__` keys when stringifying.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-123561" }, "impact_statement": "not_affected \u2014 devalue 2.0.1-tuxcare.5 contains only the serializer (default export `devalue`) in src/index.ts. It has no parse/unflatten deserializer, which first appeared in devalue 4.0.0. CVE-2026-123561 concerns key coercion bypassing parse's __proto__ rejection, so the affected code is absent. The serializer also rejects `__proto__` keys when stringifying." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:54:00.034869+00:00", "status_notes": "Vulnerability CVE-2026-123562 does not affect version 2.0.1 of devalue. not_affected \u2014 The target is devalue 2.0.1-tuxcare.5. The vulnerable feature, the asynchronous serializer `stringifyAsync`, does not exist in this version, which only has a synchronous `devalue()` function. `stringifyAsync` was introduced in devalue 5.8.0, so the unhandled-rejection pattern cannot occur here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-123562" }, "impact_statement": "not_affected \u2014 The target is devalue 2.0.1-tuxcare.5. The vulnerable feature, the asynchronous serializer `stringifyAsync`, does not exist in this version, which only has a synchronous `devalue()` function. `stringifyAsync` was introduced in devalue 5.8.0, so the unhandled-rejection pattern cannot occur here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:57:00.048642+00:00", "status_notes": "Vulnerability CVE-2026-123563 does not affect version 2.0.1 of devalue. not_affected \u2014 The target is devalue 2.0.1-tuxcare.5, which only serializes values. Its whole source is src/index.ts (404 lines). It has no parse function, no reviver mechanism and no ArrayBuffer or typed-array handling. The code the CVE describes does not exist here, so the flaw cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-123563" }, "impact_statement": "not_affected \u2014 The target is devalue 2.0.1-tuxcare.5, which only serializes values. Its whole source is src/index.ts (404 lines). It has no parse function, no reviver mechanism and no ArrayBuffer or typed-array handling. The code the CVE describes does not exist here, so the flaw cannot occur." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:46:48.037524+00:00", "status_notes": "Vulnerability CVE-2026-123564 affects version 2.0.1 of devalue.", "vulnerability": { "name": "CVE-2026-123564" }, "action_statement": "Vulnerability CVE-2026-123564 affects version 2.0.1 of devalue." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T02:05:32.300200+00:00", "status_notes": "Vulnerability CVE-2026-123565 does not affect version 2.0.1 of devalue. not_affected \u2014 devalue 2.0.1-tuxcare.5 is not affected. Its serializer (default export `devalue`, the equivalent of `uneval`) counts primitives by value and hoists every repeated primitive, strings included, into a single named parameter. A repeated string is therefore emitted once and referenced by a short name afterwards, so output stays linear in input. There is also no `parse` step in this version, so the...", "vulnerability": { "name": "CVE-2026-123565" }, "impact_statement": "not_affected \u2014 devalue 2.0.1-tuxcare.5 is not affected. Its serializer (default export `devalue`, the equivalent of `uneval`) counts primitives by value and hoists every repeated primitive, strings included, into a single named parameter. A repeated string is therefore emitted once and referenced by a short name afterwards, so output stays linear in input. There is also no `parse` step in this version, so the..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:46:48.037524+00:00", "status_notes": "Vulnerability CVE-2026-123566 affects version 2.0.1 of devalue.", "vulnerability": { "name": "CVE-2026-123566" }, "action_statement": "Vulnerability CVE-2026-123566 affects version 2.0.1 of devalue." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T02:05:52.851547+00:00", "status_notes": "Vulnerability CVE-2026-123567 does not affect version 2.0.1 of devalue. not_affected \u2014 Target is devalue 2.0.1-tuxcare.5. It exports only the `devalue` stringify function (src/index.ts), which emits JavaScript source. It has no `parse` or `unflatten` function, which is the only place CVE-2026-123567 applies. Those functions arrived in later upstream releases. The serialized-input receiver that creates objects with own `__proto__` properties does not exist here. Type A1 (input abs...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-123567" }, "impact_statement": "not_affected \u2014 Target is devalue 2.0.1-tuxcare.5. It exports only the `devalue` stringify function (src/index.ts), which emits JavaScript source. It has no `parse` or `unflatten` function, which is the only place CVE-2026-123567 applies. Those functions arrived in later upstream releases. The serialized-input receiver that creates objects with own `__proto__` properties does not exist here. Type A1 (input abs..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:46:48.037524+00:00", "status_notes": "Vulnerability CVE-2026-123568 affects version 2.0.1 of devalue.", "vulnerability": { "name": "CVE-2026-123568" }, "action_statement": "Vulnerability CVE-2026-123568 affects version 2.0.1 of devalue." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-11-08T01:46:48.037524+00:00", "status_notes": "Vulnerability CVE-2026-123569 affects version 2.0.1 of devalue.", "vulnerability": { "name": "CVE-2026-123569" }, "action_statement": "Vulnerability CVE-2026-123569 affects version 2.0.1 of devalue." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22774 does not affect version 2.0.1 of devalue. Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) is NOT vulnerable to CVE-2026-22774. This version predates the introduction of the parse/unflatten functionality where the vulnerability exists. The vulnerable code pattern (TypedArray hydration without ArrayBuffer validation) is not present in this codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-22774" }, "impact_statement": "Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) is NOT vulnerable to CVE-2026-22774. This version predates the introduction of the parse/unflatten functionality where the vulnerability exists. The vulnerable code pattern (TypedArray hydration without ArrayBuffer validation) is not present in this codebase. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-30226 does not affect version 2.0.1 of devalue. not_affected \u2014 Version 2.0.1 is not affected by CVE-2026-30226. The vulnerable functions `devalue.parse()` and `devalue.unflatten()` do not exist in this version. Version 2.0.1 uses a fundamentally different architecture: it only provides serialization to JavaScript code (via the `devalue()` function), with deserialization performed using `eval()` or `new Function()`. The custom JSON-like deserialization func...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-30226" }, "impact_statement": "not_affected \u2014 Version 2.0.1 is not affected by CVE-2026-30226. The vulnerable functions `devalue.parse()` and `devalue.unflatten()` do not exist in this version. Version 2.0.1 uses a fundamentally different architecture: it only provides serialization to JavaScript code (via the `devalue()` function), with deserialization performed using `eval()` or `new Function()`. The custom JSON-like deserialization func..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42570 does not affect version 2.0.1 of devalue. Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does not contain the vulnerable devalue.parse function. The parse functionality was first introduced in v4.0.0 (October 3, 2022), while the target is based on v2.0.1 (November 29, 2019). Version 2.0.1 only provides serialization functionality and predates the introduction of the parse feature by nearly 3 years. Since the vulnerable code pattern was never introduced in this version, the [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42570" }, "impact_statement": "Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does not contain the vulnerable devalue.parse function. The parse functionality was first introduced in v4.0.0 (October 3, 2022), while the target is based on v2.0.1 (November 29, 2019). Version 2.0.1 only provides serialization functionality and predates the introduction of the parse feature by nearly 3 years. Since the vulnerable code pattern was never introduced in this version, the [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-81176 does not affect version 2.0.1 of devalue. not_affected \u2014 CVE-2026-81176 affects devalue.parse prior to version 5.9.2, which fails to reject out-of-bounds indices leading to quadratic work (DoS). The target version 2.0.1-tuxcare.4 is NOT affected because the parse function does not exist in this version. The parse functionality was introduced in version 4.0.0 (git commit 0f5789e), years after version 2.0.1 was released. Version 2.0.1 is a serializatio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-81176" }, "impact_statement": "not_affected \u2014 CVE-2026-81176 affects devalue.parse prior to version 5.9.2, which fails to reject out-of-bounds indices leading to quadratic work (DoS). The target version 2.0.1-tuxcare.4 is NOT affected because the parse function does not exist in this version. The parse functionality was introduced in version 4.0.0 (git commit 0f5789e), years after version 2.0.1 was released. Version 2.0.1 is a serializatio..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-33hq-fvwr-56pm affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.4.", "vulnerability": { "name": "GHSA-33hq-fvwr-56pm" }, "action_statement": "Vulnerability GHSA-33hq-fvwr-56pm affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-10-01T16:50:44.847096+00:00", "status_notes": "Vulnerability GHSA-4q55-j62x-fr9h does not affect version 2.0.1 of devalue. not_affected \u2014 Version 2.0.1 is not affected by GHSA-4q55-j62x-fr9h. The vulnerability requires a `parse` function to deserialize payloads and create objects with `__proto__` own properties. However, version 2.0.1 only contains a serializer (`devalue()` function) and has no deserializer. The `parse`, `stringify`, `uneval`, and `unflatten` functions were introduced in devalue 4.0.0, making this vulnerability i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-4q55-j62x-fr9h" }, "impact_statement": "not_affected \u2014 Version 2.0.1 is not affected by GHSA-4q55-j62x-fr9h. The vulnerability requires a `parse` function to deserialize payloads and create objects with `__proto__` own properties. However, version 2.0.1 only contains a serializer (`devalue()` function) and has no deserializer. The `parse`, `stringify`, `uneval`, and `unflatten` functions were introduced in devalue 4.0.0, making this vulnerability i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-8qm3-746x-r74r affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.4.", "vulnerability": { "name": "GHSA-8qm3-746x-r74r" }, "action_statement": "Vulnerability GHSA-8qm3-746x-r74r affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-10-10T10:06:00.104411+00:00", "status_notes": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.5.", "vulnerability": { "name": "GHSA-hx4r-w6wj-j8fg" }, "action_statement": "Vulnerability GHSA-hx4r-w6wj-j8fg affects version 2.0.1 of devalue, and is fixed in 2.0.1-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-10-01T17:19:32.985642+00:00", "status_notes": "Vulnerability GHSA-mcm9-63f2-9j32 does not affect version 2.0.1 of devalue. not_affected \u2014 Version 2.0.1 is not affected by GHSA-mcm9-63f2-9j32. The vulnerability (quadratic expansion of repeated primitive strings) was introduced in 2022 when upstream commit 3b06dcd removed primitive deduplication. Version 2.0.1 (from 2019) predates this change and retains the original deduplication mechanism that prevents the amplification attack. The CVE version range \"<= 5.9.2\" is misleading as it...", "vulnerability": { "name": "GHSA-mcm9-63f2-9j32" }, "impact_statement": "not_affected \u2014 Version 2.0.1 is not affected by GHSA-mcm9-63f2-9j32. The vulnerability (quadratic expansion of repeated primitive strings) was introduced in 2022 when upstream commit 3b06dcd removed primitive deduplication. Version 2.0.1 (from 2019) predates this change and retains the original deduplication mechanism that prevents the amplification attack. The CVE version range \"<= 5.9.2\" is misleading as it..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mwv9-gp5h-frr4 does not affect version 2.0.1 of devalue. Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does NOT contain the vulnerable code. The CVE GHSA-mwv9-gp5h-frr4 affects the `devalue.parse` and `devalue.unflatten` functions, but these functions do not exist in version 2.0.1. They were first introduced in version 4.0.0 (October 2022), which is significantly later than the target version. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-mwv9-gp5h-frr4" }, "impact_statement": "Version 2.0.1 is not vulnerable. Summary: The target repository (devalue v2.0.1-tuxcare.3) does NOT contain the vulnerable code. The CVE GHSA-mwv9-gp5h-frr4 affects the `devalue.parse` and `devalue.unflatten` functions, but these functions do not exist in version 2.0.1. They were first introduced in version 4.0.0 (October 2022), which is significantly later than the target version. [terminalized not_affected from patch_application_manual/not_vulnerable]" }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-10-01T17:29:47.336236+00:00", "status_notes": "Vulnerability GHSA-r9w8-h9r3-54w4 does not affect version 2.0.1 of devalue. not_affected \u2014 Version 2.0.1-tuxcare.4 of devalue does not contain the vulnerable code. The CVE requires a `parse` function with ArrayBuffer custom reviver support. This version only provides serialization via the `devalue()` function and lacks any deserialization/parsing functionality. The `parse` function was introduced in v4.0.0 (much later than v2.0.1), and ArrayBuffer support was added around v5.6.3. Exh...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "GHSA-r9w8-h9r3-54w4" }, "impact_statement": "not_affected \u2014 Version 2.0.1-tuxcare.4 of devalue does not contain the vulnerable code. The CVE requires a `parse` function with ArrayBuffer custom reviver support. This version only provides serialization via the `devalue()` function and lacks any deserialization/parsing functionality. The `parse` function was introduced in v4.0.0 (much later than v2.0.1), and ArrayBuffer support was added around v5.6.3. Exh..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/devalue@2.0.1", "identifiers": { "purl": "pkg:npm/devalue@2.0.1" } } ], "timestamp": "2026-10-01T15:25:17.861384+00:00", "status_notes": "Vulnerability GHSA-wf3x-273g-mvxv affects version 2.0.1 of devalue.", "vulnerability": { "name": "GHSA-wf3x-273g-mvxv" }, "action_statement": "Vulnerability GHSA-wf3x-273g-mvxv affects version 2.0.1 of devalue." } ] }