Svelte devalue CVE-2026-81176

Exploitation requires that the target application call devalue.parse (or unflatten) on untrusted, attacker-supplied input on a vulnerable version prior to 5.9.2 - this is the essential precondition and is not the library's default posture, since many consumers only serialize/deserialize trusted internal data. No authentication, user interaction, or special platform is required once such a parsing path is exposed (PR:N/UI:N). The limiting factor is deployment-specific: if the app never parses external devalue data, it is not exploitable regardless of version. Impact is confined to availability (CPU/event-loop starvation); there is no code execution or data exposure.

This is a low-to-moderate real-world risk best characterized as a genuine but bounded availability issue. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, base 5.3) is internally consistent with the description: a network-reachable, unauthenticated attacker with no user interaction can send a crafted devalue payload, but the only impact is partial availability degradation (A:L) via CPU exhaustion from quadratic parsing work - no confidentiality or integrity impact, which matches CWE-770 (uncontrolled resource consumption). No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation likelihood cannot be quantified from these signals. There is no public exploit identified beyond the fix commit's regression test, which itself demonstrates the trigger pattern ('[["Set",7]]'). The most important limiting factor is NOT captured in the CVSS 'AV:N/PR:N' metrics: exploitation is only possible in applications that actually call devalue.parse on attacker-controlled/untrusted input - a design decision, not the default use of the library. This makes the practical attack surface narrower than the 'unauthenticated network' vector suggests. Overall: a real, patch-worthy DoS but not a high-urgency emergency.

An application exposes an endpoint that deserializes client-supplied data with devalue.parse (for example accepting devalue-encoded request bodies). An unauthenticated attacker submits a specially crafted payload containing out-of-bounds array indices that make the parser alternate between array representations, forcing quadratic work relative to payload size and consuming CPU/event-loop time. The fix commit includes a regression test proving the trigger, but no standalone weaponized exploit is published.