Svelte devalue CVE-2026-92708

Requires a server-side-rendered application using devalue 5.1.0-5.9.2 (e.g. SvelteKit, which bundles devalue, or Nuxt) where a publicly reachable page's load() returns a Node.js Buffer - or reads a small file that yields a Buffer - which devalue then serializes via stringify, stringifyAsync, or uneval into the rendered HTML. The leak is amplified by small Buffers because they share Node's process-wide allocation pool (Buffer.poolSize/8KB) that co-locates other requests' data; large unpooled Buffers get dedicated backing stores and leak less. Limiting factors: the app must actually serialize a raw Buffer (the documented workaround new Uint8Array(buf) or converting to Uint8Array before serialization eliminates it), the route must be reachable, and the value of leaked bytes depends on concurrent traffic placing sensitive data in the shared pool. It does NOT require authentication, user interaction, or parsing of untrusted input (parse/unflatten guards do not apply).

CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a genuine unauthenticated network-reachable confidentiality flaw, and the CVSS vector is well-supported by the source-code evidence: the pre-patch viewInfo() emits the entire backing ArrayBuffer, and for a Node Buffer that backing store is the process-wide 8KB pool (Buffer.poolSize), so up to ~64KB of unrelated process memory - including other in-flight requests' bodies and Authorization headers - can be serialized into a public HTML response. The confidentiality-only scoring (I:N/A:N) is consistent with a pure memory-disclosure primitive. No EPSS score, no CISA KEV entry, and no public exploit code are present in the input, so this is 'no public exploit identified at time of analysis' - a high-CVSS issue whose real-world exploitation is currently unproven. The practical risk is nuanced: the leak fires deterministically on every render that serializes a Buffer (no attacker interaction required to trigger it), but WHICH secret bytes land in the shared pool is opportunistic and depends on concurrent request load and allocation timing, favoring probabilistic/repeated sampling rather than reliable targeted extraction. This is a real fix-promptly issue for any SSR SvelteKit/Nuxt deployment that serializes Buffers on public routes, but the absence of KEV/EPSS/POC signals argues against imminent mass exploitation.

An attacker repeatedly requests a public, unauthenticated SSR page whose load() returns a small Node Buffer (or reads a small file). devalue serializes the Buffer's entire shared backing pool into the page HTML, so each response may embed leftover bytes from other users' concurrent requests - such as their POST bodies or Authorization headers - which the attacker harvests across many requests. No exploit code is published, but the leak triggers automatically on every such render with no authentication.