The devalue package for npm versions before 5.6.3 has a vulnerability that allows excessive CPU and memory consumption when serializing sparse arrays using uneval or stringify. This can lead to a denial of service if an attacker can create and serialize such sparse arrays on the server.