CVE-2026-123565 · Package
NO FIX YET · SEE WHAT TO DO
devalue, a JavaScript library for serializing data, expands repeated primitive strings quadratically in its uneval function. A small crafted payload can produce a very large serialized string that exhausts memory or CPU.
first public Sep 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use devalue to serialize data that can be influenced by outside users, such as request payloads that get passed to uneval, are exposed. Projects that only serialize trusted internal data, or that do not use devalue at all, can skip it.
Not affected if devalue-not-used, no-untrusted-input
Who cares javascript, node, self-hosted, svelte, sveltekit
npm ls devalue in each project.5.9.3 or later (per the advisory title, versions before 5.9.3 are affected).Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.