CVE-2026-123566 · Package
NO FIX YET · SEE WHAT TO DO
devalue is a JavaScript library for serializing values, and versions before 5.9.3 let an attacker who controls sparse array input force heavy synchronous work. The work scales with the declared array length and blocks the Node.js event loop, so the process stops serving other requests.
first public Sep 18, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that pass untrusted, attacker-influenced values into devalue's uneval are exposed, since the sparse array length drives the CPU cost. Projects that only serialize trusted server-side data can skip it. unknown whether other usage patterns are affected.
Not affected if trusted-input-only
Who cares javascript, node.js, svelte, sveltejs, sveltekit
npm ls devalue or pnpm ls devalue in each project that depends on it.uneval on data that comes from user requests.5.9.3 or laterSveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.