Description
devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.
Applications are potentially affected if they call devalue.parse with untrusted data.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): < 5.9.1
- Patched version(s): 5.9.2
References
Could your website be exposed too?
SmartScanner can check your website for Svelte devalue: DoS via malformed input and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte devalue: DoS via sparse array deserialization - CVE-2026-42570
- decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input - CVE-2026-45822
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - CVE-2026-83614
- xmldom: Quadratic-time parsing via the malformed-input recovery path — `parseElementStartPart` re-scan and `normalize()` - xmldom - CVE-2026-83614
You might also like:
See something that needs correcting? Let us knowUpdated September 17, 2026