Description
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.
Recommendation
Update the devalue package to the latest compatible version. Followings are version details:
- Affected version(s): >= 5.6.3, <= 5.8.0
- Patched version(s): 5.8.1
References
Could your website be exposed too?
SmartScanner can check your website for Svelte devalue: DoS via sparse array deserialization and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
- Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
- Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
- Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599
You might also like:
See something that needs correcting? Let us knowUpdated June 09, 2026