Threats tagged 'ghsa-6jpw-759r-8m52'

The devalue library versions 5.8.0 through before 5.9.3 contain an unhandled promise rejection vulnerability in the stringifyAsync function. This occurs when serializing multiple promises where a later promise rejects before an earlier one settles, causing an internal rejection to remain unhandled even if the caller catches the returned promise. This flaw can be exploited by an attacker who can influence the timing or failure of asynchronous values to cause the Node.js process to terminate unexpectedly.