CVE-2026-123566

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...

CVE-2026-123565

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123568

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

CVE-2026-123568

The Sveltejs devalue library, in versions prior to 5.6.3 , is vulnerable to a prototype pollution vulnerability (CWE-1321). An attacker can supply untrusted data to the uneval function to alter object prototypes. When the resulting code is subsequently evaluated, it creates objects with polluted ...

CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

EUVD-2026-119453

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

EUVD-2026-119452

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

CVE-2026-123567

Versions of Sveltejs devalue prior to 5.6.4 are vulnerable to a prototype injection flaw. The root cause is that the devalue.parse and devalue.unflatten functions allow attackers to inject proto own properties into returned objects. If downstream code merges these results using Object.assign , ...

EUVD-2026-119450

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123564

Sveltejs devalue versions 1.0.0 through before 5.9.3 contain a memory exhaustion flaw within the uneval component. The issue occurs because the generated code for sparse arrays allocates memory proportional to the array's declared length upon evaluation. An attacker capable of influencing a very ...

CVE-2026-123567: sveltejs devalue: Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__…

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

PT-2026-139848

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign,...

CVE-2026-123563: sveltejs devalue: Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip…

Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing...

PT-2026-139846

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123568: sveltejs devalue: Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object…

Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying untrusted data to uneval. When the generated code is later evaluated, it creates objects with polluted prototypes, producing output data whose shape differs fro...

CVE-2026-123564: sveltejs devalue: Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse…

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust...

CVE-2026-123565: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause…

Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhaus...

CVE-2026-123566: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU…

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the...