sveltejs/devalue · Security
Svelte devalue: DoS via malformed input
- GHSA ID
- GHSA-9rgm-9g3h-6x36
- CVE ID
- CVE-2026-81176
- Severity
- medium
- Published
- Updated
- CVSS
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS v3
- 5.3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Description
Impact
devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.
Applications are potentially affected if they call devalue.parse with untrusted data.
Patches
The bug is fixed in [email protected].
CWEs
- CWE-770 · Allocation of Resources Without Limits or Throttling
References
- https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2026-81176 ↗
- https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1 ↗
- https://github.com/sveltejs/devalue/releases/tag/v5.9.2 ↗
- https://github.com/advisories/GHSA-9rgm-9g3h-6x36 ↗