{"id":"CVE-2026-123565","kind":"vulnerability","aliases":["CVE-2026-123565"],"related":[],"title":"devalue: crafted payload exhausts memory and CPU through quadratic expansion","description":"Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.","summary":"devalue, a JavaScript library for serializing data, expands repeated primitive strings quadratically in its uneval function. A small crafted payload can produce a very large serialized string that exhausts memory or CPU.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node","package","self-hosted","svelte","sveltekit"],"not_affected_if":["devalue-not-used","no-untrusted-input"],"how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in the dependency tree of any service that passes untrusted input to uneval.","fix":"- devalue `5.9.3` or later (per the advisory title, versions before 5.9.3 are affected).","status":"open","published_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:23:03+00:00","updated_at":"2026-11-08T02:23:03+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:03Z","model":"claude-haiku-5-5","output":{"fix":"- devalue `5.9.3` or later (per the advisory title, versions before 5.9.3 are affected).","reach":"internet","title":"devalue: crafted payload exhausts memory and CPU through quadratic expansion","impact":"medium","summary":"devalue, a JavaScript library for serializing data, expands repeated primitive strings quadratically in its uneval function. A small crafted payload can produce a very large serialized string that exhausts memory or CPU.","audience":"developers","category":"package","nicknames":[],"who_cares":["svelte","sveltekit","javascript","node","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server memory or CPU exhausted, causing denial of service.","analyst_note":"Confirm the affected version range and whether the fix is 5.9.3 from the vendor advisory on github.com and the vulncheck page.","how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in the dependency tree of any service that passes untrusted input to uneval.","plain_action":"","needs_analyst":true,"not_affected_if":["no-untrusted-input","devalue-not-used"],"who_is_affected":"Applications that use devalue to serialize data that can be influenced by outside users, such as request payloads that get passed to uneval, are exposed. Projects that only serialize trusted internal data, or that do not use devalue at all, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.0007,"input_tokens":4276,"output_tokens":544,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123565':13A,16A '-2026':12A,15A '5.9.3':60C 'attack':77C 'caus':70C 'contain':61C 'cpu':7A,56B,102C 'craft':2A,43B,82C 'cve':11A,14A 'data':31B 'devalu':1A,25B,58C 'exhaust':4A,53B,64C,99C 'expand':32B 'expans':10A,72C 'function':40B,76C 'host':22B 'javascript':17B,27B 'larg':49B,95C 'librari':28B 'memori':5A,54B,100C 'node':18B 'packag':19B 'pars':86C 'pass':89C 'payload':3A,44B,83C 'primit':34B,68C 'produc':46B,92C 'quadrat':9A,36B,71C 'repeat':33B,67C 'resourc':63C 'self':21B 'self-host':20B 'serial':30B,50B,96C 'small':42B,81C 'string':35B,51B,69C,97C 'suppli':79C 'svelt':23B 'sveltej':57C 'sveltekit':24B 'unev':39B,75C,91C 'vulner':65C","nicknames":[],"mitigations":[],"who_affected":"Applications that use devalue to serialize data that can be influenced by outside users, such as request payloads that get passed to uneval, are exposed. Projects that only serialize trusted internal data, or that do not use devalue at all, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","javascript","node","package","selfhosted","svelte","sveltekit"],"campaign_type":null,"search_a":"'-123565':13A,16A '-2026':12A,15A 'cpu':7A 'craft':2A 'cve':11A,14A 'devalu':1A 'exhaust':4A 'expans':10A 'memori':5A 'payload':3A 'quadrat':9A","search_b":"'cpu':56B 'craft':43B 'data':31B 'devalu':25B 'exhaust':53B 'expand':32B 'function':40B 'host':22B 'javascript':17B,27B 'larg':49B 'librari':28B 'memori':54B 'node':18B 'packag':19B 'payload':44B 'primit':34B 'produc':46B 'quadrat':36B 'repeat':33B 'self':21B 'self-host':20B 'serial':30B,50B 'small':42B 'string':35B,51B 'svelt':23B 'sveltekit':24B 'unev':39B","search_c":"'5.9.3':60C 'attack':77C 'caus':70C 'contain':61C 'cpu':102C 'craft':82C 'devalu':58C 'exhaust':64C,99C 'expans':72C 'function':76C 'larg':95C 'memori':100C 'pars':86C 'pass':89C 'payload':83C 'primit':68C 'produc':92C 'quadrat':71C 'repeat':67C 'resourc':63C 'serial':96C 'small':81C 'string':69C,97C 'suppli':79C 'sveltej':57C 'unev':75C,91C 'vulner':65C","first_public_at":"2026-09-18T18:42:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123565","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123565","severity":null,"published_at":"2026-11-08T02:16:49+00:00","modified_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99281,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-18T18:42:08+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99282,"url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-quadratic-expansion-denial-of-service-via-uneval","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}