{"id":"CVE-2026-123566","kind":"vulnerability","aliases":["CVE-2026-123566"],"related":[],"title":"devalue: sparse arrays passed to uneval cause CPU exhaustion and blocked event loop","description":"Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.","summary":"devalue is a JavaScript library for serializing values, and versions before 5.9.3 let an attacker who controls sparse array input force heavy synchronous work. The work scales with the declared array length and blocks the Node.js event loop, so the process stops serving other requests.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node.js","package","svelte","sveltejs","sveltekit"],"not_affected_if":["trusted-input-only"],"how_to_check":"- Check the installed devalue version with `npm ls devalue` or `pnpm ls devalue` in each project that depends on it.\n- Look for calls to `uneval` on data that comes from user requests.","fix":"- devalue: upgrade to `5.9.3` or later","status":"open","published_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:23:02+00:00","updated_at":"2026-11-08T02:23:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:23:02Z","model":"claude-haiku-5-5","output":{"fix":"- devalue: upgrade to `5.9.3` or later","reach":"internet","title":"devalue: sparse arrays passed to uneval cause CPU exhaustion and blocked event loop","impact":"medium","summary":"devalue is a JavaScript library for serializing values, and versions before 5.9.3 let an attacker who controls sparse array input force heavy synchronous work. The work scales with the declared array length and blocks the Node.js event loop, so the process stops serving other requests.","audience":"developers","category":"package","nicknames":[],"who_cares":["sveltejs","svelte","sveltekit","node.js","javascript"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker blocks the server's event loop with crafted sparse arrays","analyst_note":"Confirm the affected input path and whether an unauthenticated request reaches uneval; check the vendor advisory on github.com and the vulncheck page for details.","how_to_check":"- Check the installed devalue version with `npm ls devalue` or `pnpm ls devalue` in each project that depends on it.\n- Look for calls to `uneval` on data that comes from user requests.","plain_action":"","needs_analyst":true,"not_affected_if":["trusted-input-only"],"who_is_affected":"Applications that pass untrusted, attacker-influenced values into devalue's uneval are exposed, since the sparse array length drives the CPU cost. Projects that only serialize trusted server-side data can skip it. unknown whether other usage patterns are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4269,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123566':16A,19A '-2026':15A,18A '5.9.3':37B,74C 'allow':82C 'amplif':87C 'array':3A,44B,56B,91C,110C 'attack':40B,83C,94C 'block':11A,59B,112C 'caus':7A,85C 'contain':75C 'control':42B 'cpu':8A,86C 'cve':14A,17A 'declar':55B,109C 'denial':77C 'devalu':1A,26B,72C 'event':12A,62B,114C 'exhaust':9A 'forc':46B,103C 'heavi':47B 'influenc':96C 'input':45B 'javascript':20B,29B 'length':57B,111C 'let':38B 'librari':30B 'loop':13A,63B,115C 'node.js':21B,61B 'packag':22B 'pass':4A,99C 'process':66B 'proport':106C 'request':70B 'scale':52B 'serial':32B 'serv':68B 'servic':79C 'spars':2A,43B,90C,97C 'stop':67B 'suppli':89C 'svelt':23B 'sveltej':24B,71C 'sveltekit':25B 'synchron':48B,104C 'unev':6A,93C,101C 'valu':33B,98C 'version':35B 'vulner':80C 'work':49B,51B,105C","nicknames":[],"mitigations":[],"who_affected":"Applications that pass untrusted, attacker-influenced values into devalue's uneval are exposed, since the sparse array length drives the CPU cost. Projects that only serialize trusted server-side data can skip it. unknown whether other usage patterns are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","javascript","nodejs","package","svelte","sveltejs","sveltekit"],"campaign_type":null,"search_a":"'-123566':16A,19A '-2026':15A,18A 'array':3A 'block':11A 'caus':7A 'cpu':8A 'cve':14A,17A 'devalu':1A 'event':12A 'exhaust':9A 'loop':13A 'pass':4A 'spars':2A 'unev':6A","search_b":"'5.9.3':37B 'array':44B,56B 'attack':40B 'block':59B 'control':42B 'declar':55B 'devalu':26B 'event':62B 'forc':46B 'heavi':47B 'input':45B 'javascript':20B,29B 'length':57B 'let':38B 'librari':30B 'loop':63B 'node.js':21B,61B 'packag':22B 'process':66B 'request':70B 'scale':52B 'serial':32B 'serv':68B 'spars':43B 'stop':67B 'svelt':23B 'sveltej':24B 'sveltekit':25B 'synchron':48B 'valu':33B 'version':35B 'work':49B,51B","search_c":"'5.9.3':74C 'allow':82C 'amplif':87C 'array':91C,110C 'attack':83C,94C 'block':112C 'caus':85C 'contain':75C 'cpu':86C 'declar':109C 'denial':77C 'devalu':72C 'event':114C 'forc':103C 'influenc':96C 'length':111C 'loop':115C 'pass':99C 'proport':106C 'servic':79C 'spars':90C,97C 'suppli':89C 'sveltej':71C 'synchron':104C 'unev':93C,101C 'valu':98C 'vulner':80C 'work':105C","first_public_at":"2026-09-18T18:42:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123566","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123566","severity":null,"published_at":"2026-11-08T02:16:49+00:00","modified_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99283,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-09-18T18:42:31+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99284,"url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-cpu-amplification-denial-of-service-via-uneval","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}