GitHub Advisoryadvisory · npm

GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input

MEDIUM Published 2026-09-17 Modified 2026-09-17 Official page ↗
Aliases
CVE-2026-81176
Ecosystem
npm
Packages
devalue
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-770
Reviewed
2026-09-17

Affected packages

• npm devalue: < 5.9.2 → fixed in 5.9.2

Description

Impact `devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if they call `devalue.parse` with untrusted data. Patches The bug is fixed in `[email protected]`.

Related

Alias · CVE (1)

  • CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References