CVE-2026-42570
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk33th percentile - higher than 33% of all known CVEs
Summary
The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.
Risk Assessment
Risk of memory exhaustion on the server or browser, potentially leading to denial of service (DoS) and application disruption.
Recommendation
Upgrade the devalue library to version 5.8.1 or later.
Other vulnerabilities in Svelte devalue
See all- CVE-2026-22775High
Svelte devalue library versions 5.1.0 through 5.6.1 are vulnerable to a denial of service (DoS) attack via excessive CPU and memory consumption when parsing specially crafted input. The issue stems from missing input validation before base64 decoding during ArrayBuffer hydration.
- CVE-2026-22774High
Svelte devalue library versions 5.3.0 through 5.6.1 contain a denial of service vulnerability. Malformed inputs can cause excessive CPU and memory consumption during devalue.parse, affecting systems that parse untrusted data.
Original NVD description (English source)
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.