~ / search / GHSA-9rgm-9g3h-6x36

GHSA-9rgm-9g3h-6x36

Svelte devalue: DoS via malformed input

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-81176

Packages

EcosystemPackageAffectedFixed in
npm devalue < 5.9.2 5.9.2

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact `devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size. Applications are potentially affected if they call `devalue.parse` with untrusted data. ### Patches The bug is fixed in `[email protected]`.

References

External links from the advisory. They lead to third-party sites.