CVE-2026-22774
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Svelte devalue library versions 5.3.0 through 5.6.1 contain a denial of service vulnerability. Malformed inputs can cause excessive CPU and memory consumption during devalue.parse, affecting systems that parse untrusted data.
Risk Assessment
The organization risks service disruption (DoS) if the application uses devalue.parse on externally supplied data. An attacker can send crafted input to overload the server.
Recommendation
Immediately update Svelte devalue to version 5.6.2 or later, which includes the fix for this vulnerability.
Other vulnerabilities in Svelte devalue
See all- CVE-2026-42570High
The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.
- CVE-2026-22775High
Svelte devalue library versions 5.1.0 through 5.6.1 are vulnerable to a denial of service (DoS) attack via excessive CPU and memory consumption when parsing specially crafted input. The issue stems from missing input validation before base64 decoding during ArrayBuffer hydration.
Original NVD description (English source)
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking the assumption before creating the typed array. This vulnerability is fixed in 5.6.2.