7.5
Élevée
CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for…
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| devalue 5.6 | 5.6.3 → < 5.8.1 | 5.8.1 |
| Red Hat Build of Podman Desktop | Versions non publiées | |
| Red Hat Trusted Artifact Signer | Versions non publiées | |
| Red Hat Trusted Artifact Signer 1.4 1783327185 | premières → < 1783327185 | 1783327185 |
| Red Hat Enterprise Linux 10 | Versions non publiées |
Autres CVE de devalue
Les 16 CVE de devalue →
CVE-2026-123569
Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
8.7
Élevée
CVE-2026-123568
Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
2.1
Faible
CVE-2026-123566
Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
8.7
Élevée
CVE-2026-123567
Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
6.3
Moyenne