devalue: `stringify`/`uneval` serialize shared memory

Impact stringify and uneval serialize a typed array by emitting its backing ArrayBuffer, not just the view. In the case of a Node Buffer object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node...

CVE-2026-92708

A flaw was found in devalue, a JavaScript library for serializing values. The stringify and uneval functions incorrectly serialize Node Buffers by emitting the entire backing ArrayBuffer instead of only the view. This vulnerability allows for the disclosure of up to 64 KB of unrelated process...

CVE-2026-92708

Svelte devalue is a JavaScript serialization library for use with SvelteKit, Nuxt, and other frameworks. In versions 5.1.0 through 5.9.2 , the stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view. Since a Node Buffer's backing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

CVE-2026-92708: Exposure of Sensitive Information to an Unauthorized Actor

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing...

GHSA-33HQ-FVWR-56PM devalue affected by CPU and memory amplification from sparse arrays

Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse arra...

devalue affected by CPU and memory amplification from sparse arrays

Under certain circumstances, serializing sparse arrays using uneval or stringify could cause CPU and/or memory exhaustion. When this occurs on the server, it results in a DoS. This is extremely difficult to take advantage of in practice, as an attacker would have to manage to create a sparse arra...

GHSA-8QM3-746X-R74R devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Under certain circumstances, unevaling untrusted data can produce output code that will create objects with polluted prototypes when later evaled, meaning the output data can be a different shape from the input data...