CVE-2026-22775
High · 7.5devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
CVSS
7.5
EPSS
0.6%
Published
Jan 15, 2026
CISA due date
—
The record
Certain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using `devalue.parse` on externally-supplied data. The root cause is the `ArrayBuffer` hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | devalue | 5.1.0 | 5.6.2 |
Related vulnerabilities
- GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Same vulnerability
- CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization Also affects devalue
- GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__`… Also affects devalue
- GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten Also affects devalue
- CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays Also affects devalue
- GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Also affects devalue