{"id":"CVE-2026-123562","kind":"vulnerability","aliases":["CVE-2026-123562"],"related":[],"title":"devalue: unhandled promise rejection can crash Node.js process","description":"devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.","summary":"devalue versions 5.8.0 before 5.9.3 mishandle promise rejections inside stringifyAsync when several promises are serialized. A later rejection can leave an internal rejection unhandled, even when the caller catches the result, and that can terminate the Node.js process.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devalue","node.js","package","sveltekit"],"not_affected_if":["no-untrusted-input","sync-only-usage"],"how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project that uses it.\n- Look for devalue in the dependency tree of SvelteKit apps and other Node.js services that call stringifyAsync.","fix":"- devalue `5.9.3` or later (fixed version per the sources).","status":"open","published_at":"2026-11-08T02:16:48+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","triaged_at":"2026-11-08T02:23:05+00:00","updated_at":"2026-11-08T02:23:05+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T02:23:05Z","model":"claude-haiku-5-5","output":{"fix":"- devalue `5.9.3` or later (fixed version per the sources).","reach":"unknown","title":"devalue: unhandled promise rejection can crash Node.js process","impact":"medium","summary":"devalue versions 5.8.0 before 5.9.3 mishandle promise rejections inside stringifyAsync when several promises are serialized. A later rejection can leave an internal rejection unhandled, even when the caller catches the result, and that can terminate the Node.js process.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","sveltekit","devalue"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker can crash the Node.js server process via timing or failure","analyst_note":"","how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project that uses it.\n- Look for devalue in the dependency tree of SvelteKit apps and other Node.js services that call stringifyAsync.","plain_action":"","needs_analyst":false,"not_affected_if":["sync-only-usage","no-untrusted-input"],"who_is_affected":"Node.js code that uses devalue's stringifyAsync to serialize multiple asynchronous values, where an attacker can influence the timing or failure of those values. Projects that do not call stringifyAsync or that run only synchronous serialization are likely not affected. Exact exposure depends on whether untrusted input reaches the promise chain.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000704,"input_tokens":4316,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123562':11A,14A '-2026':10A,13A '5.8.0':21B,59C '5.9.3':23B,61C 'abl':97C 'asynchron':106C 'attack':96C 'caller':46B,90C 'catch':47B,91C 'contain':62C 'crash':6A 'cve':9A,12A 'devalu':1A,15B,19B,57C 'earlier':79C 'even':43B,87C 'failur':103C 'influenc':99C 'insid':27B 'intern':40B,84C 'later':35B,74C 'leav':38B,82C 'mishandl':24B 'multipl':71C 'node.js':7A,16B,55B,111C 'one':80C 'packag':17B 'process':8A,56B,112C 'promis':3A,25B,31B,65C,72C,75C,94C 'reject':4A,26B,36B,41B,66C,76C,85C 'result':49B 'return':93C 'serial':33B,70C,105C 'settl':81C 'sever':30B 'stringifyasync':28B,68C 'sveltejs/devalue':58C 'sveltekit':18B 'termin':53B,109C 'time':101C 'unhandl':2A,42B,64C,86C 'valu':107C 'version':20B","nicknames":[],"mitigations":[],"who_affected":"Node.js code that uses devalue's stringifyAsync to serialize multiple asynchronous values, where an attacker can influence the timing or failure of those values. Projects that do not call stringifyAsync or that run only synchronous serialization are likely not affected. Exact exposure depends on whether untrusted input reaches the promise chain.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devalue","high","nodejs","package","sveltekit"],"campaign_type":null,"search_a":"'-123562':11A,14A '-2026':10A,13A 'crash':6A 'cve':9A,12A 'devalu':1A 'node.js':7A 'process':8A 'promis':3A 'reject':4A 'unhandl':2A","search_b":"'5.8.0':21B '5.9.3':23B 'caller':46B 'catch':47B 'devalu':15B,19B 'even':43B 'insid':27B 'intern':40B 'later':35B 'leav':38B 'mishandl':24B 'node.js':16B,55B 'packag':17B 'process':56B 'promis':25B,31B 'reject':26B,36B,41B 'result':49B 'serial':33B 'sever':30B 'stringifyasync':28B 'sveltekit':18B 'termin':53B 'unhandl':42B 'version':20B","search_c":"'5.8.0':59C '5.9.3':61C 'abl':97C 'asynchron':106C 'attack':96C 'caller':90C 'catch':91C 'contain':62C 'devalu':57C 'earlier':79C 'even':87C 'failur':103C 'influenc':99C 'intern':84C 'later':74C 'leav':82C 'multipl':71C 'node.js':111C 'one':80C 'process':112C 'promis':65C,72C,75C,94C 'reject':66C,76C,85C 'return':93C 'serial':70C,105C 'settl':81C 'stringifyasync':68C 'sveltejs/devalue':58C 'termin':109C 'time':101C 'unhandl':64C,86C 'valu':107C","first_public_at":"2026-09-18T18:40:18+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123562","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123562","severity":null,"published_at":"2026-11-08T02:16:48+00:00","modified_at":"2026-11-08T02:16:48+00:00","first_seen_at":"2026-11-08T02:21:11+00:00","fetched_at":"2026-11-08T02:21:11+00:00","note":null}],"documents":[{"id":99275,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-18T18:40:18+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99276,"url":"https://www.vulncheck.com/advisories/devalue-5.8.0-before-5.9.3-denial-of-service-via-stringifyasync-unhandled-rejection","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}