Svelte devalue CVE-2026-123566

Exploitation requires the target application to pass attacker-influenced values into devalue's uneval() function, and specifically to allow an attacker to control a sparse array whose declared length is large; uneval then performs synchronous work proportional to that declared length. The decisive LIMITING factor, stated by the vendor, is that getting an attacker to create and route a controlled sparse array into uneval is very difficult in practice, which sharply constrains realistic exploitation despite the network-reachable, unauthenticated vector. Impact is confined to availability (event-loop blocking / process stall); no data exposure or modification occurs. Applications that never call uneval on untrusted input are not exposed.

Signals conflict sharply here. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VA:H) yields a high 8.7 score implying trivial remote unauthenticated availability impact, yet the authoritative GHSA advisory explicitly states that 'attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.' That caveat directly contradicts the AC:L/AT:N (low complexity, no attack requirement) metrics in the input vector, so the 8.7 overstates real-world risk. The vuln.today priority is 'this_week' (not act_now/emergency), and there is no CISA KEV listing and no EPSS score in the input. There is no public exploit identified at time of analysis - only the vendor advisory and the fix commit are referenced. Net: this is a genuine but low-probability, hard-to-trigger DoS that affects availability only (no confidentiality or integrity impact); treat it as routine patching (this week) rather than an emergency. The AC:L/AT:N vs. 'very difficult to exploit' mismatch should be verified against the vendor advisory before acting on the raw CVSS number.

A Node.js/SvelteKit application that calls devalue's uneval() on data a remote user can influence receives a request crafted so that a sparse array with a very large declared length (e.g. length set high but few real elements) reaches uneval. uneval then performs synchronous work proportional to the declared length, stalling the single-threaded event loop and denying service to all other requests. No public exploit code is identified, and the vendor notes that getting an attacker-controlled sparse array to reach uneval is very difficult in practice.