---
id: CVE-2026-123562
title: >-
  Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled
  Rejection
summary: >-
  devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise
  rejection in stringifyAsync: when serializing multiple promises, a later
  promise rejecting before an earlier one settles leaves an internal rejection
  unhandled, …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-248
vendor: sveltejs
product: devalue
affected:
  - devalue >= 5.8.0 < 5.9.3
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:02.433Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123562'
references:
  - url: >-
      https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g
    label: GitHub Security Advisory (GHSA-x5rw-q4pp-hg5g)
  - url: >-
      https://www.vulncheck.com/advisories/devalue-5.8.0-before-5.9.3-denial-of-service-via-stringifyasync-unhandled-rejection
    label: >-
      VulnCheck Advisory: Devalue 5.8.0 before 5.9.3 Denial of Service via
      stringifyAsync Unhandled Rejection
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.662Z'
---

## Overview

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

## Affected

- `devalue >= 5.8.0 < 5.9.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.