GHSA-g2pg-6438-jwpf
High · 7.5CVSS
7.5
EPSS
—
Published
Jan 15, 2026
CISA due date
—
The record
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | devalue | 5.1.0 | 5.6.2 |
Related vulnerabilities
- CVE-2026-22775 devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Same vulnerability
- CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization Also affects devalue
- GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__`… Also affects devalue
- GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten Also affects devalue
- CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays Also affects devalue
- GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Also affects devalue