Skip to content
Sign in
8.7 High

CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

Description

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
devalue 5.9 earliest → < 5.9.3 5.9.3
devalue 5.8 5.8.0 → < 5.9.3 5.9.3

Other CVEs of devalue

The 16 CVEs of devalue →
CVE-2026-123569 Devalue before 5.6.3 Denial of Service via Sparse Array Serialization 8.7 High CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output 2.1 Low CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval 8.7 High CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten 6.3 Medium
Track this CVE