Skip to content
Sign in
8.7 High

CVE-2026-123564 Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Description

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.

CVSS 4.0 detail

Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Exploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.

Attack vector
Network
Attack complexity
Low
Attack requirements
None
Privileges required
None
Interaction
None
Confidentiality
None
Integrity
None
Availability
High
Confidentiality of other systems
None
Integrity of other systems
None
Availability of other systems
None

Affected products and versions

Product Affected versions Fixed in
devalue 5.9 earliest → < 5.9.3 5.9.3
devalue 1.0 1.0.0 → < 5.9.3 5.9.3

Other CVEs of devalue

The 16 CVEs of devalue →
CVE-2026-123569 Devalue before 5.6.3 Denial of Service via Sparse Array Serialization 8.7 High CVE-2026-123568 Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output 2.1 Low CVE-2026-123566 Devalue before 5.9.3 CPU Amplification Denial of Service via uneval 8.7 High CVE-2026-123567 Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten 6.3 Medium
Track this CVE