# CVE-2026-123563: Devalue validation bypass in ArrayBuffer reviver

Source: https://junglewise.ai/threats/cve-2026-123563-devalue-before-5-9-3-contains-a-validation-bypass-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-08. Updated: 2026-11-08  
License: CC BY 4.0 with a link back

CVE-2026-123563 · Severity: high · CVSS 7.5 · Published 2026-11-08

Devalue is a JavaScript library that serializes and deserializes data structures. Attackers can craft malicious input that exploits a validation bypass in custom ArrayBuffer handlers to force allocation of extremely large memory blocks, causing the application to crash or become unresponsive due to memory exhaustion.

Technologies: [Svelte Devalue](https://junglewise.ai/threats/technologies/svelte-devalue). Vendors: [Svelte](https://junglewise.ai/threats/vendors/svelte).

## Quick answers

**Is CVE-2026-123563 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123563 being exploited in the wild.

**How severe is CVE-2026-123563?** High severity, with a CVSS score of 7.5, published 8 November 2026.

**Which products and versions are affected?** Svelte Devalue before 5.9.3.

**Is there a fix for CVE-2026-123563?** Yes: fixed in 5.9.3. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-123563 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123563?** Check whether you run Svelte Devalue at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.9.3

## Technical details

The vulnerability is a memory allocation validation bypass (CWE-789) in the parse function where custom ArrayBuffer revivers can circumvent typed-array allocation checks. An attacker supplies crafted input with a malformed ArrayBuffer reviver that, despite small input size, triggers allocation of massive ArrayBuffers. This is a denial-of-service attack requiring only network access to a service using vulnerable Devalue versions; no authentication or user interaction is needed.

## Affected products

- Svelte Devalue before 5.9.3

## Timeline

- 2026-09-18: disclosed: GitHub Security Advisory GHSA-r9w8-h9r3-54w4 published
- 2026-11-08: advisory

## References

- [https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4](https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4)
- [https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse](https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)