MEDIUM

CVE-2026-81176

2026-09-16 CVSS v3.1

CVSS

5.3

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.

Weakness (CWE)

CWE-770 Resource Allocation Without Limits

EPSS Score

0.49%

Probability of exploitation in next 30 days

40.8th percentile

References

https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1 https://github.com/sveltejs/devalue/releases/tag/v5.9.2 https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE