MEDIUM 5.3 npm
Svelte devalue: DoS via malformed input
GHSA-9rgm-9g3h-6x36 · CVE-2026-81176
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
Impact
devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.
Applications are potentially affected if they call devalue.parse with untrusted data.
Patches
The bug is fixed in devalue@5.9.2.
References
- WEB https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-81176
- WEB https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1
- PACKAGE https://github.com/sveltejs/devalue
- WEB https://github.com/sveltejs/devalue/releases/tag/v5.9.2
Ready to move
Start Securing
Free, no credit card | First findings in minutes