Svelte devalue CVE-2026-123564

Exploitation requires an application to use devalue's uneval to serialize data that an attacker can influence, where that serialized data can declare a very large sparse array, AND the generated code is subsequently evaluated in a browser or runtime - the vendor explicitly states this does NOT affect the default parse sparse-array construction path. Limiting factors: the application must both emit uneval output AND evaluate it on attacker-influenced sparse arrays, which is a non-default usage pattern; in the common uneval use case of sending data to a client, the worst outcome is a single client browser tab running out of memory rather than server-side impact. No authentication is indicated by the CVSS vector (PR:N), and no user interaction is required (UI:N).

The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) with availability-only impact (VA:H) describes a network-reachable, low-complexity, unauthenticated denial-of-service affecting the availability of the system that evaluates the generated code - there is no confidentiality or integrity impact (VC:N/VI:N). The score of 8.7 is driven almost entirely by that high availability impact under default-looking metrics. However, the vendor advisory sharply narrows real-world risk: exploitation only matters 'if you were serializing very large sparse arrays and then evaluating the results' with uneval, and the vendor notes the worst general-case outcome is a client browser tab running out of memory - a self-inflicted client-side crash rather than server-side compromise. No EPSS score, no CISA KEV listing, and no PoC/exploit reference were provided, so there is no evidence of active exploitation or public weaponization; the vuln.today Decision label is this_week, not act_now or emergency. Net assessment: this is a legitimate but bounded availability issue whose raw CVSS 4.0 score overstates practical danger, because the AC:L/PR:N metrics do not capture the non-default usage pattern (uneval output being eval'd on large sparse arrays) that is actually required. CWE labeling is inconsistent across sources (NVD CWE-770 vs. advisory CWE-400 and CWE-789), but all point to uncontrolled/eager resource allocation.

An application uses devalue's uneval to serialize data that an attacker can influence, and the resulting generated code is later evaluated in a browser or runtime. The attacker supplies a tiny serialized value declaring a very large sparse array, which on evaluation triggers memory allocation proportional to the declared length, exhausting memory and crashing the evaluating tab or process. No public exploit code was identified at time of analysis, and because the attack vector is network with low complexity (AV:N/AC:L), delivery is straightforward wherever the vulnerable serialize-then-evaluate pattern exists.