---
id: "CVE-2026-123566"
page: "https://infrastack.ai/live/CVE-2026-123566"
kind: "vulnerability"
aliases: ["CVE-2026-123566"]
title: "devalue: sparse arrays passed to uneval cause CPU exhaustion and blocked event loop"
severity: "high"
cvss: 8.7
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["javascript", "node.js", "package", "svelte", "sveltejs", "sveltekit"]
not_affected_if: ["trusted-input-only"]
published_at: "2026-11-08T02:16:49+00:00"
first_seen_at: "2026-11-08T02:21:12+00:00"
updated_at: "2026-11-08T02:23:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123566", "first_seen_at": "2026-11-08T02:21:12+00:00"}]
exploit_sources: []
---

# devalue: sparse arrays passed to uneval cause CPU exhaustion and blocked event loop

Link for people: https://infrastack.ai/live/CVE-2026-123566 (this .md is for agents)

devalue is a JavaScript library for serializing values, and versions before 5.9.3 let an attacker who controls sparse array input force heavy synchronous work. The work scales with the declared array length and blocks the Node.js event loop, so the process stops serving other requests.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed devalue version with `npm ls devalue` or `pnpm ls devalue` in each project that depends on it.
- Look for calls to `uneval` on data that comes from user requests.

## Fix

- devalue: upgrade to `5.9.3` or later

## Timeline

- 2026-11-08T02:21:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123566

## Documents

- [advisory] Vendor advisory: github.com https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg
- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/devalue-before-5.9.3-cpu-amplification-denial-of-service-via-uneval

## From the sources

Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying sparse arrays to uneval. Attackers who influence sparse values passed to uneval can force synchronous work proportional to the declared array length, blocking the event loop.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_