devalue EUVD-2026-35500

The devalue library (pkg:npm/devalue) provides serialization/deserialization primitives used in Svelte and SvelteKit frameworks. The vulnerability resides in the sparse array deserialization logic within devalue.parse. The SPARSE encoding format [-7, length, idx, val, ...] previously called new Array(length) directly on untrusted length values. In V8 JavaScript engine (Chrome, Node.js), array lengths below ~10^8 trigger eager allocation of contiguous backing stores. An attacker-controlled payload declaring arrays with huge lengths (e.g., 100 million) but minimal actual data forces the parser to allocate gigabytes of memory. This is a CWE-770 (Allocation of Resources Without Limits or Throttling) issue where input validation failed to prevent resource exhaustion. The patch addresses this by first touching array[MAX_ARRAY_INDEX] to force V8 into dictionary-elements mode, where length becomes a number property without contiguous allocation, then deleting that index and setting the final length safely.