Svelte devalue vulnerabilities

The Svelte devalue JavaScript library versions 5.6.3 through 5.8.0 is vulnerable to excessive memory consumption when deserializing sparse arrays. An attacker can exploit JavaScript engine quirks to force devalue.parse to allocate much more memory than needed.

Svelte devalue library versions 5.1.0 through 5.6.1 are vulnerable to a denial of service (DoS) attack via excessive CPU and memory consumption when parsing specially crafted input. The issue stems from missing input validation before base64 decoding during ArrayBuffer hydration.

Svelte devalue library versions 5.3.0 through 5.6.1 contain a denial of service vulnerability. Malformed inputs can cause excessive CPU and memory consumption during devalue.parse, affecting systems that parse untrusted data.