CVE-2026-42570

The record

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

Affected packages

Related vulnerabilities

• GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization Same vulnerability
• GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__`… Also affects devalue
• GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten Also affects devalue
• CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
• GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays Also affects devalue
• GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Also affects devalue
• GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Also affects devalue
• GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse Also affects devalue