Svelte devalue: DoS via sparse array deserialization

Description

devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.6.3, <= 5.8.0
• Patched version(s): 5.8.1

References

• GHSA-77vg-94rm-hx3p
• CVE-2026-42570
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Svelte affected by cross-site scripting via spread attributes in Svelte SSR - CVE-2026-27121
• Axios: unbounded recursion in toFormData causes DoS via deeply nested request data - CVE-2026-42039
• Qwik City has array method pollution in FormData processing allows type confusion and DoS - CVE-2026-32701
• Svelte SSR vulnerable to cross-site scripting via spread attributes - CVE-2026-42599

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

devalue