Junglewise Threat Intelligence

CVE-2026-22774: Svelte devalue denial of service in devalue.parse

CVE-2026-22774 · Severity: high · CVSS 7.5 · Published 2026-01-15

Technologies: devalue (npm), Red Hat Trusted Artifact Signer, Red Hat Build of Podman Desktop. Vendors: npm, Red Hat, Svelte.

Executive brief

Svelte devalue is a JavaScript library used to convert complex data structures into strings for storage or transmission. A vulnerability in the library allows attackers to send specially crafted data that causes the system to consume excessive memory and CPU power. This can lead to a denial-of-service (DoS) condition, making the affected application or service unavailable to legitimate users.

Technical details

A denial-of-service vulnerability exists in the Svelte devalue library due to improper input validation during typed array hydration. The 'devalue.parse' function expects an ArrayBuffer as input for certain operations but fails to verify this assumption before attempting to create a typed array. An unauthenticated remote attacker can exploit this by providing specially crafted input that triggers asymmetric resource consumption (CWE-405), leading to memory exhaustion or CPU spikes. This affects any application using devalue to parse externally-supplied data. The issue is resolved in version 5.6.2 by adding proper validation for ArrayBuffer and typed array inputs.

Affected products

  • Svelte devalue >= 5.3.0, < 5.6.2
  • Red Hat Red Hat Trusted Artifact Signer 1.2 1.2.2
  • Red Hat Red Hat Trusted Artifact Signer 1.3 1.3.2
  • Red Hat Red Hat Build of Podman Desktop 0

Timeline

  • 2026-01-15: disclosed: Initial disclosure and GitHub advisory published
  • 2026-01-15: patched: Version 5.6.2 released
  • 2026-02-05: advisory: Red Hat published security advisory RHSA-2026:2144
  • 2026-02-18: advisory: Red Hat published security advisory RHSA-2026:2926

References

Related threats