---
id: "CVE-2026-123562"
page: "https://infrastack.ai/live/CVE-2026-123562"
kind: "vulnerability"
aliases: ["CVE-2026-123562"]
title: "devalue: unhandled promise rejection can crash Node.js process"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["devalue", "node.js", "package", "sveltekit"]
not_affected_if: ["no-untrusted-input", "sync-only-usage"]
published_at: "2026-11-08T02:16:48+00:00"
first_seen_at: "2026-11-08T02:21:11+00:00"
updated_at: "2026-11-08T02:23:05+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123562", "first_seen_at": "2026-11-08T02:21:11+00:00"}]
exploit_sources: []
---

# devalue: unhandled promise rejection can crash Node.js process

Link for people: https://infrastack.ai/live/CVE-2026-123562 (this .md is for agents)

devalue versions 5.8.0 before 5.9.3 mishandle promise rejections inside stringifyAsync when several promises are serialized. A later rejection can leave an internal rejection unhandled, even when the caller catches the result, and that can terminate the Node.js process.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed devalue version with `npm ls devalue` in each project that uses it.
- Look for devalue in the dependency tree of SvelteKit apps and other Node.js services that call stringifyAsync.

## Fix

- devalue `5.9.3` or later (fixed version per the sources).

## Timeline

- 2026-11-08T02:21:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123562

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/devalue-5.8.0-before-5.9.3-denial-of-service-via-stringifyasync-unhandled-rejection

## From the sources

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_