TI-2026-86704 Aliases CVE-2026-123562 GHSA-6jpw-759r-8m52

Unhandled promise rejection in devalue stringifyAsync enables denial of service

LOW 38CWE-248Published 2026-11-08 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

The devalue package from sveltejs, versions from 5.8.0 before 5.9.3, contains an unhandled promise rejection in stringifyAsync (CWE-248). When several promises are serialized and a later one rejects before an earlier one settles, an internal rejection stays unhandled even when the caller catches the returned promise. An unauthenticated remote attacker who can influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

Why it matters now

EPSS 0.00343 28th percentileScored 2026-11-08

Fix Fixed devalue (sveltejs): 5.9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sveltejs	devalue	5.8.0 to before 5.9.3	5.9.3	Patch available	CNA

devalue Vendorsveltejs Affected 5.8.0 to before 5.9.3 Fixed in 5.9.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:svelte:devalue::::::::	—	—	sveltejs

cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:* Versions — — ·sveltejs

Remediation

Update devalue to version 5.9.3, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Fix · CNA devalue (sveltejs) Fixed in 5.9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-11-08
sveltejs devalue 5.9.3
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-86708 CPU amplification in devalue via sparse arrays in unevalPriority LOW 38
- TI-2026-86707 Quadratic expansion in devalue uneval enables denial of servicePriority LOW 38
- TI-2026-86706 Memory exhaustion in Sveltejs devalue via uneval sparse arraysPriority LOW 38
Show all 6 records →

Timeline

2026-11-08 Threatist record created from CVE-2026-123562
2026-11-08 Alias added: GHSA-6jpw-759r-8m52
2026-11-09 Priority changed: MEDIUM → LOW

References

Advisory 1

GitHub Security Advisory (GHSA-x5rw-q4pp-hg5g)

TI-2023-13469 SvelteKit framework has Insufficient CSRF protection for CORS requests CVSS 3.1HIGH 8.8
TI-2023-13464 SvelteKit has Insufficient Cross-Site Request Forgery Protection CVSS 3.1HIGH 8.8
TI-2024-15660 Sending a GET or HEAD request with a body crashes SvelteKit CVSS 3.1HIGH 7.5
TI-2024-30159 Potential mXSS vulnerability due to improper HTML escaping in svelte CVSS 3.1MEDIUM 6.1
TI-2025-23466 SvelteKit allows XSS via tracked search_params CVSS 3.1MEDIUM 5.4
TI-2025-13940 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVSS 4.0MEDIUM 5.3

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences