~ / search / GHSA-77vg-94rm-hx3p

GHSA-77vg-94rm-hx3p

Svelte devalue: DoS via sparse array deserialization

Source: GitHub Advisory Database (reviewed) High CVE-2026-42570

Packages

EcosystemPackageAffectedFixed in
npm devalue >= 5.6.3, < 5.8.1 5.8.1

Details

As written in the advisory (Markdown source, shown as plain text).

`devalue.parse` could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.

References

External links from the advisory. They lead to third-party sites.