CVE-2026-22775
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk43th percentile - higher than 43% of all known CVEs
Summary
Svelte devalue library versions 5.1.0 through 5.6.1 are vulnerable to a denial of service (DoS) attack via excessive CPU and memory consumption when parsing specially crafted input. The issue stems from missing input validation before base64 decoding during ArrayBuffer hydration.
Risk Assessment
Organizations using devalue.parse to process data from untrusted sources (e.g., APIs, forms) are at risk of a DoS attack that could render the application or system unavailable.
Recommendation
Immediately update the Svelte devalue library to version 5.6.2 or later. If an update is not possible, restrict access to the parse function to trusted data sources only.
Other vulnerabilities in Svelte devalue
See all- CVE-2026-42570High
The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.
- CVE-2026-22774High
Svelte devalue library versions 5.3.0 through 5.6.1 contain a denial of service vulnerability. Malformed inputs can cause excessive CPU and memory consumption during devalue.parse, affecting systems that parse untrusted data.
Original NVD description (English source)
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.