CVE-2026-123562

The devalue (sveltejs/devalue) library versions 5.8.0 before 5.9.3 is vulnerable to a Denial of Service via an unhandled promise rejection in the stringifyAsync function. When serializing multiple promises, if a later promise rejects before an earlier one settles, an internal rejection remains un...