CVEvulnerability
CVE-2026-42570
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2026-06-09
- Last modified
- 2026-08-24
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS 3.1 (0b0ca135-0b70-47e7-9f44-1890c2a1c46c)
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Weaknesses
- CWE-770
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
Affected configurations
• svelte devalue (>= 5.6.3 < 5.8.1)
Related
Weakness · CWE (1)
- CWE-770 Allocation of Resources Without Limits or Throttling weakness
References
- https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d Patch
- https://github.com/sveltejs/devalue/releases/tag/v5.8.1 Product, Release Notes
- https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:37272 access.redhat.com
- https://access.redhat.com/errata/RHSA-2026:57590 access.redhat.com
- https://access.redhat.com/security/cve/CVE-2026-42570 access.redhat.com
- https://bugzilla.redhat.com/show_bug.cgi?id=2487050 bugzilla.redhat.com
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42570.json security.access.redhat.com