CVE-2026-123565

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123566

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123568

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

CVE-2026-123568

The Sveltejs devalue library, in versions prior to 5.6.3 , is vulnerable to a prototype pollution vulnerability (CWE-1321). An attacker can supply untrusted data to the uneval function to alter object prototypes. When the resulting code is subsequently evaluated, it creates objects with polluted ...

CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

EUVD-2026-119453

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

CVE-2026-123566

Sveltejs devalue versions before 5.9.3 are vulnerable to a Denial of Service (DoS) attack. The root cause is a CPU amplification issue within the uneval function, where providing sparse arrays can force the system to perform synchronous work proportional to the declared array length. This results...

EUVD-2026-119452

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

CVE-2026-123567

Versions of Sveltejs devalue prior to 5.6.4 are vulnerable to a prototype injection flaw. The root cause is that the devalue.parse and devalue.unflatten functions allow attackers to inject proto own properties into returned objects. If downstream code merges these results using Object.assign , ...

EUVD-2026-119451

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123565

The devalue library (versions prior to 5.9.3 ) is vulnerable to a resource exhaustion (Denial of Service) flaw due to quadratic expansion in the uneval function. Attackers can provide a small, crafted payload consisting of repeated primitive strings; when parsed and processed by uneval, it genera...

EUVD-2026-119450

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123565 Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123564

Sveltejs devalue versions 1.0.0 through before 5.9.3 contain a memory exhaustion flaw within the uneval component. The issue occurs because the generated code for sparse arrays allocates memory proportional to the array's declared length upon evaluation. An attacker capable of influencing a very ...

EUVD-2026-119449

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

PT-2026-139848

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

PT-2026-139846

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123563: sveltejs devalue: Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip…

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing...

CVE-2026-123567: sveltejs devalue: Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__…

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...