Svelte devalue: DoS via sparse array deserialization

Description

devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

Recommendation

Update the devalue package to the latest compatible version. Followings are version details:

• Affected version(s): >= 5.6.3, <= 5.8.0
• Patched version(s): 5.8.1

References

• GHSA-77vg-94rm-hx3p
• CVE-2026-42570
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Undici has Unbounded Memory Consumption in its DeduplicationHandler via Response Buffering that leads to DoS - CVE-2026-2581
• Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
• Parse Server has Denial of Service (DoS) and Cloud Function Dispatch Bypass via Prototype Chain Resolution - CVE-2026-30939
• Svelte: XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers - CVE-2026-27902

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

Update Cheat Sheet for Developers

Tags:

npm

devalue