Read the docs
TI-2026-30850 Aliases CVE-2026-42570GHSA-77vg-94rm-hx3p

Svelte devalue: DoS via sparse array deserialization

Priority LOW 39CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00397 34th percentileScored 2026-11-07
Fix Partial devalue (sveltejs): 5.8.1devalue (npm): 5.8.1Red Hat: 2 advisoriesRed Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
sveltejsdevalue5.6.3 to before 5.8.15.8.1Patch availableCNA
—devalue (npm)5.6.3 to before 5.8.15.8.1Patch availableGHSA-77vg-94rm-hx3p
  • devalue Vendorsveltejs Affected 5.6.3 to before 5.8.1 Fixed in 5.8.1 Patch available CNA
  • devalue (npm) Vendor— Affected 5.6.3 to before 5.8.1 Fixed in 5.8.1 Patch available GHSA-77vg-94rm-hx3p

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*:*5.6.3 to before 5.8.1Vulnerablesveltejs
  • cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*:* Versions 5.6.3 to before 5.8.1 Vulnerable ·sveltejs

Remediation

  • Fix · CNA devalue (sveltejs) Fixed in 5.8.1
  • Fix · GHSA-77vg-94rm-hx3p devalue (npm) Fixed in 5.8.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:57590 Released 2026-08-20 · Red Hat rating Important
    rh-podman-desktop security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Extensions Channel (v. 10) rh-podman-desktop-1.1.2-1.el10_2
  • RHSA-2026:37272 Released 2026-07-09 · Red Hat rating Important
    RHTAS 1.4.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.4 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +6

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Build of Podman DesktopAffectedNo fix yet
Red Hat Enterprise Linux Extensions Channel (v. 10)Fixed RHSA-2026:57590
Red Hat Trusted Artifact Signer 1.4Fixed RHSA-2026:37272
Not affected: 1 product
  • Red Hat Trusted Artifact Signer 1.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-42570
  2. 2026-10-03 Alias added: GHSA-77vg-94rm-hx3p
  3. 2026-10-25 EPSS moved to the below the 50th percentile
  4. 2026-10-25 Priority changed: MEDIUM → LOW

References

Patch 1

Advisory 2

Other 2

  • TI-2026-18293 devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse CVSS 3.1HIGH 7.5
  • TI-2026-18292 devalue vulnerable to denial of service due to memory exhaustion in devalue.parse CVSS 3.1HIGH 7.5
  • TI-2026-23459 devalue has prototype pollution in devalue.parse and devalue.unflatten CVSS 4.0MEDIUM 6.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences