8.7
High
CVE-2026-123569 Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
Description
The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.
CVSS 4.0 detail
Vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NExploitable remotely over the network, without an account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- Interaction
- None
- Confidentiality
- None
- Integrity
- None
- Availability
- High
- Confidentiality of other systems
- None
- Integrity of other systems
- None
- Availability of other systems
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| devalue 5.6 | earliest → < 5.6.3 | 5.6.3 |
Other CVEs of devalue
The 16 CVEs of devalue →
CVE-2026-123568
Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
2.1
Low
CVE-2026-123566
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
8.7
High
CVE-2026-123567
Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
6.3
Medium
CVE-2026-123565
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
8.7
High