sveltejs/devalue · Security
Svelte devalue: DoS via sparse array deserialization
- GHSA ID
- GHSA-77vg-94rm-hx3p
- CVE ID
- CVE-2026-42570
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p ↗
- https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d ↗
- https://github.com/sveltejs/devalue/releases/tag/v5.8.1 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-42570 ↗
- https://github.com/advisories/GHSA-77vg-94rm-hx3p ↗