Is CVE-2026-22774 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22774 being exploited in the wild.

How severe is CVE-2026-22774?

High severity, with a CVSS score of 7.5, published 15 January 2026.

Which products and versions are affected?

devalue (npm) SEMVER:introduced=5.3.0,fixed=5.6.2; Red Hat Trusted Artifact Signer 1.2.2.

Is there a fix for CVE-2026-22774?

Yes. devalue (npm): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22774 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22774?

Check whether you run devalue (npm) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22774: Svelte devalue denial of service in devalue.parse

CVE-2026-22774 · Severity: high · CVSS 7.5 · Published 2026-01-15

Svelte devalue is a JavaScript library used to convert complex data structures into strings for storage or transmission. A vulnerability in the library allows attackers to send specially crafted data that causes the system to consume excessive memory and CPU power. This can lead to a denial-of-service (DoS) condition, making the affected application or service unavailable to legitimate users.

Technologies: devalue (npm), Red Hat Trusted Artifact Signer. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-22774 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22774 being exploited in the wild.
How severe is CVE-2026-22774?: High severity, with a CVSS score of 7.5, published 15 January 2026.
Which products and versions are affected?: devalue (npm) SEMVER:introduced=5.3.0,fixed=5.6.2; Red Hat Trusted Artifact Signer 1.2.2.
Is there a fix for CVE-2026-22774?: Yes. devalue (npm): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22774 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22774?: Check whether you run devalue (npm) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

devalue (npm): upgrade to 5.6.2 or later
```
npm install devalue@5.6.2
```

Technical details

A denial-of-service vulnerability exists in the Svelte devalue library due to improper input validation during typed array hydration. The 'devalue.parse' function expects an ArrayBuffer as input for certain operations but fails to verify this assumption before attempting to create a typed array. An unauthenticated remote attacker can exploit this by providing specially crafted input that triggers asymmetric resource consumption (CWE-405), leading to memory exhaustion or CPU spikes. This affects any application using devalue to parse externally-supplied data. The issue is resolved in version 5.6.2 by adding proper validation for ArrayBuffer and typed array inputs.

Affected products

Svelte devalue >= 5.3.0, < 5.6.2
Red Hat Red Hat Trusted Artifact Signer 1.2 1.2.2
Red Hat Red Hat Trusted Artifact Signer 1.3 1.3.2
Red Hat Red Hat Build of Podman Desktop 0

Identifiers

CVE-2026-22774
GHSA-vw5p-8cq8-m7mv

Timeline

2026-01-15: disclosed: Initial disclosure and GitHub advisory published
2026-01-15: patched: Version 5.6.2 released
2026-02-05: advisory: Red Hat published security advisory RHSA-2026:2144
2026-02-18: advisory: Red Hat published security advisory RHSA-2026:2926

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.