CVE-2026-123569High· 7.5▾ TwilightThe devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.
devalue < 5.6.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-123564High· 7.5Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-81176Medium· 5.3Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job
CVE-2026-123562High· 7.5Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123563High· 7.5Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
CVE-2026-123561Low· 3.7Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion
CVE-2026-123566High· 7.5Devalue before 5.9.3 CPU Amplification Denial of Service via uneval