Read the docs
TI-2026-18293 Aliases CVE-2026-22775GHSA-g2pg-6438-jwpf

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

Priority MEDIUM 40CWE-405Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00625 50th percentileScored 2026-11-07
Fix Partial devalue (sveltejs): 5.6.2devalue (npm): 5.6.2Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sveltejsdevalue5.1.0 to before 5.6.25.6.2Patch availableCNA
—devalue (npm)5.1.0 to before 5.6.25.6.2Patch availableGHSA-g2pg-6438-jwpf
  • devalue Vendorsveltejs Affected 5.1.0 to before 5.6.2 Fixed in 5.6.2 Patch available CNA
  • devalue (npm) Vendor— Affected 5.1.0 to before 5.6.2 Fixed in 5.6.2 Patch available GHSA-g2pg-6438-jwpf

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*:*5.1.0 to before 5.6.2Vulnerablesveltejs
  • cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*:* Versions 5.1.0 to before 5.6.2 Vulnerable ·sveltejs

Remediation

  • Fix · CNA devalue (sveltejs) Fixed in 5.6.2
  • Fix · GHSA-g2pg-6438-jwpf devalue (npm) Fixed in 5.6.2 Advisory →

Red Hat 2 advisories

  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
  • RHSA-2026:2144 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman Desktop - Tech PreviewAffectedNo fix yet
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2926
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:2144
Not affected: 2 products
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22775
  2. 2026-10-03 Alias added: GHSA-g2pg-6438-jwpf
  3. 2026-11-03 EPSS moved to the 50th–90th percentile

References

Patch 1

Advisory 2

Other 2

  • TI-2026-18292 devalue vulnerable to denial of service due to memory exhaustion in devalue.parse CVSS 3.1HIGH 7.5
  • TI-2026-30850 Svelte devalue: DoS via sparse array deserialization CVSS 3.1HIGH 7.5
  • TI-2026-23459 devalue has prototype pollution in devalue.parse and devalue.unflatten CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences