@agent-harness-experimental/workflow (>=0.0.1, <=0.0.5), @ai_kit/workflow-world (>=0.1.0, <=0.2.0) +145 more potentially affected by CVE-2026-92708 via devalue (>=5.1.1, <=5.9.2)

devalue NPM version =5.1.1, =0.0.1, =0.1.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.0-dev.20251108074143, =4.2.3, =3.8.8, =3.8.8, =3.8.7, =3.8.7, =0.1.1, =4.3.15, =4.3.33 and more Source cves: CVE-2026-92708 Source advisory: MEND:CVE-2026-92708...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CLSA-2026-1789752547 TuxCare security update for devalue (3 CVEs)

TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.3-tuxcare.5...

CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

PT-2026-102425

TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.3-tuxcare.5...

NPM: Svelte devalue: DoS via malformed input

NPM: Svelte devalue: DoS via malformed input vulnerability discovered by ? in WordPress Npm devalue versions 5.9.1...

EUVD-2026-80943

Svelte devalue: DoS via malformed input...

@alexkroman1/aai (>=6.1.0, <=9.2.0), @alexkroman1/aai-cli (>=6.1.0, <=9.2.0) +83 more potentially affected by CVE-2026-81176 via devalue (>=5.0.0, <=5.9.0)

devalue NPM version =5.0.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.9, =0.6.3, =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.4-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0, =1.21.56-beta.0, =1.21.83-beta.0 and more...

@alexkroman1/aai (>=6.1.0, <=9.2.0), @alexkroman1/aai-cli (>=6.1.0, <=9.2.0) +83 more potentially affected by CVE-2026-81176 via devalue (>=5.0.0, <=5.9.0)

devalue NPM version =5.0.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.9, =0.6.3, =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.4-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0, =1.21.56-beta.0, =1.21.83-beta.0 and more...

GHSA-9RGM-9G3H-6X36 Svelte devalue: DoS via malformed input

Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...

Svelte devalue: DoS via malformed input

Impact devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if the...

Allocation of Resources Without Limits or Throttling

Overview devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the parse function. An attacker can cause...

@alexkroman1/aai (>=6.1.0, <=9.2.0), @alexkroman1/aai-cli (>=6.1.0, <=9.2.0) +83 more potentially affected by CVE-2026-81176 via devalue (>=5.0.0, <=5.9.0)

devalue NPM version =5.0.0, =6.1.0, =6.1.0, =7.0.0, =6.1.0, =0.3.0, =0.0.9, =0.6.3, =1.22.35, =1.22.102-beta.feature-lab-task-sandbox-beta.0, =1.21.52-beta.0, =1.22.4-beta.development.0, =1.22.13-beta.development.0, =1.22.39, =1.22.11-beta.development.0, =1.21.56-beta.0, =1.21.83-beta.0 and more...

CVE-2026-81176

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

CVE-2026-81176

A flaw was found in the Svelte devalue library. An attacker can provide a specially crafted, untrusted payload to the devalue.parse function. This malformed input, specifically out-of-bounds indices, can cause the parser to perform quadratic work, leading to a denial of service DoS in application...

CVE-2026-81176 Svelte devalue: DoS via malformed input

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

CVE-2026-81176

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

CVE-2026-81176 Svelte devalue: DoS via malformed input

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload c...

0xrtest (1.0.0), 3nit-utils (>=0.30.0, <=1.0.2) +1387 more potentially affected by CVE-2026-81176 via devalue (>=1.1.1, <=5.9.0)

devalue NPM version =1.1.1, =0.30.0, =0.0.0-canary.0, =0.0.11, =0.1.0, =1.1.0, =1.0.1, =1.1.0, =0.0.27, =1.0.0, =0.2.2, =0.2.8 and more Source cves: CVE-2026-81176 Source advisory: MEND:CVE-2026-81176...