ETK-2026-311Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-311",
  "cve_id": null,
  "display_id": "ETK-2026-311",
  "ghsa_id": "GHSA-mcm9-63f2-9j32",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Serialization expansion in devalue",
  "summary": "Affected npm devalue versions can turn a small value into a very large serialized string when data processed with parse is later passed to uneval. An attacker able to influence data in that processing flow may cause excessive serialized output and associated resource use.",
  "mitigation": "Upgrade npm devalue to version 5.9.3 or later. Until upgrading, avoid passing untrusted or attacker-influenced parsed data to uneval.",
  "vendor": "npm",
  "product": "npm:devalue",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "<= 5.9.2"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "5.9.3"
      ],
      "package_name": "devalue",
      "purl": "pkg:npm/devalue"
    }
  ],
  "cwes": null,
  "cvss_score": 8.2,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.015053066666667,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-01T15:17:29+00:00",
      "days": -19.822422469895834,
      "is_lower_bound": true,
      "measured_at": "2026-10-21T11:01:46.342229+00:00",
      "url": "https://github.com/advisories/GHSA-mcm9-63f2-9j32"
    }
  }
}