CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

devalue sveltejs/devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker...