{"id":"CVE-2026-123569","kind":"vulnerability","aliases":["CVE-2026-123569"],"related":[],"title":"devalue npm package: sparse arrays drain CPU and memory during serialization","description":"The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.","summary":"The devalue npm package before 5.6.3 uses excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who gets a sparse array created on the server and serialized there can cause a denial of service.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["devalue","node","npm","package","server-side-serialization"],"not_affected_if":["no-devalue-dependency","no-server-serialization"],"how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in package.json dependencies and lockfiles.","fix":"- devalue: upgrade to `5.6.3` or later.","status":"open","published_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","triaged_at":"2026-11-08T02:22:59+00:00","updated_at":"2026-11-08T02:22:59+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-08T02:22:59Z","model":"claude-haiku-5-5","output":{"fix":"- devalue: upgrade to `5.6.3` or later.","reach":"unknown","title":"devalue npm package: sparse arrays drain CPU and memory during serialization","impact":"medium","summary":"The devalue npm package before 5.6.3 uses excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who gets a sparse array created on the server and serialized there can cause a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","devalue","node","server-side-serialization"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Server process exhausts CPU and memory, causing denial of service","analyst_note":"","how_to_check":"- Check the installed devalue version with `npm ls devalue` in each project.\n- Look for devalue in package.json dependencies and lockfiles.","plain_action":"","needs_analyst":false,"not_affected_if":["no-server-serialization","no-devalue-dependency"],"who_is_affected":"Applications that call devalue's uneval or stringify on server-side data that could contain sparse arrays created from attacker input. Projects that do not serialize data with devalue on the server, or that never let outside input create sparse arrays, are less exposed. The sources do not say which frameworks embed devalue by default.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":4260,"output_tokens":503,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123569':14A,17A '-2026':13A,16A '5.6.3':31B,71C 'allow':105C 'array':5A,40B,51B,81C,94C 'attack':46B,87C 'caus':60B,110C 'consum':73C 'cpu':7A,34B,75C 'creat':52B,95C 'cve':12A,15A 'denial':62B,112C 'devalu':1A,18B,27B,66C 'drain':6A 'excess':33B,74C 'format':102C 'get':48B,91C 'mainstream':100C 'manag':89C 'memori':9A,36B,77C 'node':19B 'npm':2A,20B,28B,69C 'packag':3A,21B,29B,67C 'serial':11A,25B,38B,57B,79C,107C 'server':23B,55B,98C 'server-side-seri':22B 'servic':64B,114C 'side':24B 'spars':4A,39B,50B,80C,93C 'stringifi':44B,85C 'unev':42B,83C 'use':32B 'wire':101C","nicknames":[],"mitigations":[],"who_affected":"Applications that call devalue's uneval or stringify on server-side data that could contain sparse arrays created from attacker input. Projects that do not serialize data with devalue on the server, or that never let outside input create sparse arrays, are less exposed. The sources do not say which frameworks embed devalue by default.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["devalue","high","node","npm","package","serversideserialization"],"campaign_type":null,"search_a":"'-123569':14A,17A '-2026':13A,16A 'array':5A 'cpu':7A 'cve':12A,15A 'devalu':1A 'drain':6A 'memori':9A 'npm':2A 'packag':3A 'serial':11A 'spars':4A","search_b":"'5.6.3':31B 'array':40B,51B 'attack':46B 'caus':60B 'cpu':34B 'creat':52B 'denial':62B 'devalu':18B,27B 'excess':33B 'get':48B 'memori':36B 'node':19B 'npm':20B,28B 'packag':21B,29B 'serial':25B,38B,57B 'server':23B,55B 'server-side-seri':22B 'servic':64B 'side':24B 'spars':39B,50B 'stringifi':44B 'unev':42B 'use':32B","search_c":"'5.6.3':71C 'allow':105C 'array':81C,94C 'attack':87C 'caus':110C 'consum':73C 'cpu':75C 'creat':95C 'denial':112C 'devalu':66C 'excess':74C 'format':102C 'get':91C 'mainstream':100C 'manag':89C 'memori':77C 'npm':69C 'packag':67C 'serial':79C,107C 'server':98C 'servic':114C 'spars':80C,93C 'stringifi':85C 'unev':83C 'wire':101C","first_public_at":"2026-02-18T20:31:30+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123569","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123569","severity":null,"published_at":"2026-11-08T02:16:49+00:00","modified_at":"2026-11-08T02:16:49+00:00","first_seen_at":"2026-11-08T02:21:12+00:00","fetched_at":"2026-11-08T02:21:12+00:00","note":null}],"documents":[{"id":99289,"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-02-18T20:31:30+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":99290,"url":"https://www.vulncheck.com/advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serialization","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}