TI-2026-86706 Aliases CVE-2026-123564 GHSA-97c7-3pc7-pw7r

Memory exhaustion in Sveltejs devalue via uneval sparse arrays

LOW 38CWE-770Published 2026-11-08 · Updated 2026-11-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, where generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. An unauthenticated remote attacker who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime that evaluates the output.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.

Why it matters now

EPSS 0.00343 28th percentileScored 2026-11-08

Fix Fixed devalue (sveltejs): 5.9.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
sveltejs	devalue	1.0.0 to before 5.9.3	5.9.3	Patch available	CNA

devalue Vendorsveltejs Affected 1.0.0 to before 5.9.3 Fixed in 5.9.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:svelte:devalue::::::::	—	—	sveltejs

cpe:2.3:a:svelte:devalue:*:*:*:*:*:*:*:* Versions — — ·sveltejs

Remediation

Upgrade sveltejs devalue to version 5.9.3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Fix · CNA devalue (sveltejs) Fixed in 5.9.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-11-08
sveltejs devalue 5.9.3
6 records Highest priority Priority LOW 6 LOW
Other records, highest priority first
- TI-2026-86708 CPU amplification in devalue via sparse arrays in unevalPriority LOW 38
- TI-2026-86707 Quadratic expansion in devalue uneval enables denial of servicePriority LOW 38
- TI-2026-86705 Validation bypass in Devalue parse allows memory exhaustionPriority LOW 38
Show all 6 records →

Timeline

2026-11-08 Threatist record created from CVE-2026-123564
2026-11-08 Alias added: GHSA-97c7-3pc7-pw7r
2026-11-09 Priority changed: MEDIUM → LOW

References

Advisory 1

GitHub Security Advisory (GHSA-wf3x-273g-mvxv)

TI-2023-13469 SvelteKit framework has Insufficient CSRF protection for CORS requests CVSS 3.1HIGH 8.8
TI-2023-13464 SvelteKit has Insufficient Cross-Site Request Forgery Protection CVSS 3.1HIGH 8.8
TI-2024-15660 Sending a GET or HEAD request with a body crashes SvelteKit CVSS 3.1HIGH 7.5
TI-2024-30159 Potential mXSS vulnerability due to improper HTML escaping in svelte CVSS 3.1MEDIUM 6.1
TI-2025-23466 SvelteKit allows XSS via tracked search_params CVSS 3.1MEDIUM 5.4
TI-2025-13940 Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVSS 4.0MEDIUM 5.3

See all 50 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences