CVE-2026-81176: Allocation of Resources Without Limits or Throttling

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

devalue: devalue: Excessive memory consumption via deserialization of sparse arrays

A flaw was found in devalue, a JavaScript library used for serializing values. Due to quirks in some JavaScript engines, the devalue.parse function could be exploited by a remote attacker when deserializing specially crafted sparse arrays. This could lead to excessive memory consumption, resultin...

CLSA-2026-1787147253 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.2-tuxcare.2...

CLSA-2026-1786357331 TuxCare security update for devalue (5 CVEs)

TuxCare rebuilt devalue to address 5 CVEs. Fixed in 4.3.2-tuxcare.1...

CLSA-2026-1778805970 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.4...

CLSA-2026-1774398079 TuxCare security update for devalue (1 CVE)

TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.1...

ROOT-APP-NPM-CVE-2025-57820 CVE-2025-57820 in @rootio/devalue - Patched by Root

Root has patched CVE-2025-57820 in the @rootio/devalue package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-30226 CVE-2026-30226 in @rootio/devalue - Patched by Root

Root has patched CVE-2026-30226 in the @rootio/devalue package for Root:npm. Multiple fixed versions available...

CVE-2026-42570

A flaw was found in devalue, a JavaScript library used for serializing values. Due to quirks in some JavaScript engines, the devalue.parse function could be exploited by a remote attacker when deserializing specially crafted sparse arrays. This could lead to excessive memory consumption, resultin...

CVE-2026-42570

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

CVE-2026-42570

CVE-2026-42570 affects the Svelte devalue library. devalue.parse could allocate excessive memory when deserializing sparse arrays in versions 5.6.3 through 5.8.0, due to engine quirks. The issue is fixed in version 5.8.1. Affected references include GitHub advisories GHSA-77vg-94rm-hx3p and OSV e...

CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

EUVD-2026-35500

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

devalue 安全漏洞

devalue is an enhanced JavaScript object serialization library developed by Svelte. Versions of devalue from 5.6.3 to 5.8.1 contained a security vulnerability. This vulnerability stemmed from excessive memory allocation during the deserialization of sparse arrays, which could lead to excessive...

CVE-2026-42570: Allocation of Resources Without Limits or Throttling

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the parse function. An attack...

@ekairos/cli (>=1.22.35, <=1.22.106-beta.feature-context-event-reaction-architecture.0), @ekairos/context (>=1.22.102-beta.feature-lab-task-sandbox-beta.0, <=1.22.106-beta.feature-context-event-reaction-architecture.0) +31 more potentially affected by CVE-2026-42570 via devalue (5.6.3)

devalue NPM version 5.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on devalue and may be impacted: - @ekairos/cli =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.9-beta.development.0, =1.22.13-beta.development.0,...

NPM: Svelte devalue: DoS via sparse array deserialization

NPM: Svelte devalue: DoS via sparse array deserialization vulnerability discovered by ? in WordPress Npm devalue versions = 5.6.3, = 5.8.0...