MajorCritical vulnerability
devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise
GitHub Advisories · officialPublished Oct 1, 2026Risk 37/100
When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed. This is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.
Recommended action
Recommended action
Upgrade affected packages to a patched version: devalue 5.9.3.
Technical details
- Vendor
- Not specified
- Product
- devalue
- Exploitation
- none known
- Evidence
- official
Evidence and sources
This record is attributed to GitHub Advisories. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.
Open primary source