---
id: CVE-2026-123566
title: Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
summary: >-
  Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that
  allows attackers to cause CPU amplification by supplying sparse arrays to
  uneval. Attackers who influence sparse values passed to uneval can force
  synchronous …
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: cna
cwe:
  - CWE-400
vendor: sveltejs
product: devalue
affected:
  - devalue < 5.9.3
published: '2026-11-08'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T01:38:05.159Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-123566'
references:
  - url: >-
      https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg
    label: GitHub Security Advisory (GHSA-hx4r-w6wj-j8fg)
  - url: >-
      https://www.vulncheck.com/advisories/devalue-before-5.9.3-cpu-amplification-denial-of-service-via-uneval
    label: >-
      VulnCheck Advisory: Devalue before 5.9.3 CPU Amplification Denial of
      Service via uneval
tags:
  - cve.org
ingestedAt: '2026-11-08T02:43:18.660Z'
---

## Overview

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.

## Affected

- `devalue < 5.9.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.