From 9bd744d8ad61aaf0aca8c2e623c1272463ab4641 Mon Sep 17 00:00:00 2001
From: 0xPierre <43297207+0xpierre-dev@users.noreply.github.com>
Date: Wed, 11 Nov 2026 02:29:47 +0100
Subject: [PATCH] fix(react-form-start): bump devalue to ^5.9.3

---
 .changeset/react-form-start-devalue.md | 5 +++++
 packages/react-form-start/package.json | 2 +-
 pnpm-lock.yaml                         | 9 +++++++--
 3 files changed, 13 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/react-form-start-devalue.md

diff --git a/.changeset/react-form-start-devalue.md b/.changeset/react-form-start-devalue.md
new file mode 100644
index 0000000000..1cf074303c
--- /dev/null
+++ b/.changeset/react-form-start-devalue.md
@@ -0,0 +1,5 @@
+---
+'@tanstack/react-form-start': patch
+---
+
+Bump `devalue` to `^5.9.3`. Earlier versions are affected by published advisories, including two denial of service issues in `devalue.parse`, which is used to read the form state cookie.
diff --git a/packages/react-form-start/package.json b/packages/react-form-start/package.json
index 3b3af1d4b5..fcd36ea364 100644
--- a/packages/react-form-start/package.json
+++ b/packages/react-form-start/package.json
@@ -49,7 +49,7 @@
   "dependencies": {
     "@tanstack/react-form": "workspace:*",
     "decode-formdata": "^0.9.0",
-    "devalue": "^5.3.2"
+    "devalue": "^5.9.3"
   },
   "devDependencies": {
     "@tanstack/react-start": "^1.168.60",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4379ca1f20..c3acb964f1 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -2006,8 +2006,8 @@ importers:
         specifier: ^0.9.0
         version: 0.9.0
       devalue:
-        specifier: ^5.3.2
-        version: 5.8.1
+        specifier: ^5.9.3
+        version: 5.9.4
     devDependencies:
       '@tanstack/react-start':
         specifier: ^1.168.60
@@ -9112,6 +9112,9 @@ packages:
   devalue@5.8.1:
     resolution: {integrity: sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==}
 
+  devalue@5.9.4:
+    resolution: {integrity: sha512-sPAT4pztbu6586/hrhOnMKS17IJrvg12mXiSPSS3W5qDeN2RGgvZ0diZCm31dBbnevfVmujNO3IM2wrS4Y2Rhg==}
+
   diff@5.2.2:
     resolution: {integrity: sha512-vtcDfH3TOjP8UekytvnHH1o1P4FcUdt4eQ1Y+Abap1tk/OB2MWQvcwS2ClCd1zuIhc3JKOx6p3kod8Vfys3E+A==}
     engines: {node: '>=0.3.1'}
@@ -23585,6 +23588,8 @@ snapshots:
 
   devalue@5.8.1: {}
 
+  devalue@5.9.4: {}
+
   diff@5.2.2: {}
 
   diff@8.0.4: {}