CVE-2026-123566

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123569

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of servic...

CVE-2026-123569

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of servic...

EUVD-2026-119454

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of servic...

CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123566

Sveltejs devalue versions before 5.9.3 are vulnerable to a Denial of Service (DoS) attack. The root cause is a CPU amplification issue within the uneval function, where providing sparse arrays can force the system to perform synchronous work proportional to the declared array length. This results...

CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

EUVD-2026-119451

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123564 Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

CVE-2026-123564 Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

CVE-2026-123564

Sveltejs devalue versions 1.0.0 through before 5.9.3 contain a memory exhaustion flaw within the uneval component. The issue occurs because the generated code for sparse arrays allocates memory proportional to the array's declared length upon evaluation. An attacker capable of influencing a very ...

CVE-2026-123569: sveltejs devalue: The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with…

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of servic...

CVE-2026-123564: sveltejs devalue: Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse…

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

CVE-2026-123566: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU…

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

PT-2026-139847

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

Allocation of Resources Without Limits or Throttling

Overview flat is a Take a nested Javascript object and flatten it, or unflatten an object with delimited keys Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unflatten, which creates huge sparse arrays when processing flattened objects...

CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

CVE-2026-119051 flat through 6.0.1 Denial of Service via unflatten() Numeric Array Index Keys

flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten that allows attackers to create huge sparse arrays via unbounded numeric keys. Attackers can supply flattened keys such as a.4294967294, causing iteration with forEach, spread or JSON.stringify to block the...

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate uneval output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default parse sparse-array...