CVE-2026-123564 · Package
NO FIX YET · SEE WHAT TO DO
devalue is a JavaScript library that serializes values, and its uneval output for sparse arrays allocates memory proportional to the declared array length when evaluated. An attacker who can influence a very large sparse array the application serializes can exhaust memory in the browser or runtime that evaluates the output.
first public Sep 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use devalue 1.0.0 through versions before 5.9.3 and call uneval on data an outside party can influence, especially very large sparse arrays, which are then evaluated in a browser or runtime. Projects that do not use uneval or only serialize trusted data are less exposed.
Not affected if devalue-5.9.3-or-later, no-uneval-use, trusted-input-only
Who cares browser, javascript, node.js, svelte, sveltekit
npm ls devalue in the project.devalue and see whether any resolved version is below 5.9.3.uneval in the application code and whether the output is evaluated.5.9.3 or later.Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.