devalue stringifyAsync unhandled promise rejection can crash Node.js

high severity · published 2026-11-08

An attacker who can influence the timing or failure of promises being serialized can trigger an unhandled promise rejection in stringifyAsync, which terminates the Node.js process even when the caller catches the returned promise.

Fixed in: 5.9.3

CVE: CVE-2026-123562

Source: NVD

Am I affected?

You are affected if the installed version is older than 5.9.3. Check the version you have and update to 5.9.3 or later. The fixed version is verified against a vendor or advisory source.

Get the fix

FixLane has a reviewed fix procedure for this incident: a read-only check first, then the fix. Ask the Telegram bot, or connect an AI agent to the FixLane MCP server and call get_fix_prompt with incident id 1838 and your operating system.