Svelte devalue CVE-2026-123565

Exploitation requires an application built on devalue (<= 5.9.2) that both parses attacker-controllable data with devalue and subsequently passes the parsed result to the uneval function - the advisory describes this as occurring 'under very constrained circumstances,' so it is not a default-configuration remote DoS. The attacker-controlled payload consists of repeated primitive strings that produce quadratic expansion during serialization. Limiting factors: the vulnerable round-trip (parse then uneval on untrusted input) must exist in the deployed application code; impact is confined to availability (memory/CPU exhaustion) with no data exposure or code execution; and only versions at or below 5.9.2 are affected.

The input CVSS 4.0 base score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and an availability-only impact (VA:H; VC:N/VI:N). That profile describes a network-reachable, unauthenticated, no-interaction denial-of-service condition with no confidentiality or integrity impact - consistent with the CWE-400/CWE-409 resource-exhaustion classification. Mitigating this raw severity, the GHSA advisory explicitly states the flaw triggers only 'under very constrained circumstances' - specifically when an application both parses attacker-supplied data with devalue and then passes that result to uneval - so real-world exposure depends on that application pattern rather than on default library use. The decision signals point to measured rather than crisis urgency: the vuln.today priority label is 'this_week' (not act_now/emergency), there is no CISA KEV listing (not actively exploited), and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. No public exploit code or PoC reference is present in the input; only vendor/coordinator advisories and the patch commit are referenced. Net assessment: a genuine but bounded availability risk - prioritize patching to 5.9.3 on the normal weekly cycle, weighting higher only for services that expose the parse-then-uneval round-trip to untrusted input.

An attacker sends a small crafted payload composed of repeated primitive strings to an application endpoint that deserializes input with devalue's parse and later re-serializes it with uneval. The quadratic expansion inflates the small input into a very large serialized string, exhausting server memory or CPU and denying service to legitimate users. No public exploit identified at time of analysis; exploitation requires the application to perform the parse-then-uneval round-trip on untrusted data.