EUVD-2026-80943Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Network-reachable unauthenticated parse of untrusted input (AV:N/PR:N/UI:N) with a low-complexity crafted payload (AC:L); impact is availability-only CPU exhaustion (A:L), no C/I.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.
AnalysisAI
Quadratic-complexity denial of service in the Svelte devalue JavaScript deserializer (all versions prior to 5.9.2) lets remote attackers stall Node/browser consuming processes by feeding a crafted serialized string to devalue.parse. Because the parser fails to reject indices greater than or equal to values.length in src/parse.js, a payload can alternate between array representations and force work that grows quadratically with payload size; the CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms this is unauthenticated and requires no user interaction, with impact limited to availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target application call devalue.parse (or unflatten) on untrusted, attacker-supplied input on a vulnerable version prior to 5.9.2 - this is the essential precondition and is not the library's default posture, since many consumers only serialize/deserialize trusted internal data. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a low-to-moderate real-world risk best characterized as a genuine but bounded availability issue. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to devalue 5.9.2, the exact vendor-released patch version, which adds the bounds check that throws `Invalid input` for any index >= values.length; the fix is documented in the GitHub Security Advisory https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36, delivered by commit https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1 and tagged at https://github.com/sveltejs/devalue/releases/tag/v5.9.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously craft
Denial of service in Svelte devalue library versions 5.1.0 through 5.6.1 allows remote attackers to exhaust CPU and memo
Denial of service in Svelte devalue versions 5.3.0 through 5.6.1 allows remote attackers to exhaust CPU and memory resou
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today