# CVE-2026-22774: Svelte devalue denial of service in devalue.parse

Source: https://junglewise.ai/threats/cve-2026-22774-svelte-devalue-denial-of-service-in-devalue-parse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-01-15. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-22774 · Severity: high · CVSS 7.5 · Published 2026-01-15

Svelte devalue is a JavaScript library used to convert complex data structures into strings for storage or transmission. A vulnerability in the library allows attackers to send specially crafted data that causes the system to consume excessive memory and CPU power. This can lead to a denial-of-service (DoS) condition, making the affected application or service unavailable to legitimate users.

Technologies: [devalue (npm)](https://junglewise.ai/threats/technologies/devalue), [Red Hat Trusted Artifact Signer](https://junglewise.ai/threats/technologies/trusted-artifact-signer). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-22774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-22774 being exploited in the wild.

**How severe is CVE-2026-22774?** High severity, with a CVSS score of 7.5, published 15 January 2026.

**Which products and versions are affected?** devalue (npm) SEMVER:introduced=5.3.0,fixed=5.6.2; Red Hat Trusted Artifact Signer 1.2.2.

**Is there a fix for CVE-2026-22774?** Yes. devalue (npm): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-22774 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-22774?** Check whether you run devalue (npm) or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devalue (npm): upgrade to 5.6.2 or later

  ```sh
  npm install devalue@5.6.2
  ```


## Technical details

A denial-of-service vulnerability exists in the Svelte devalue library due to improper input validation during typed array hydration. The 'devalue.parse' function expects an ArrayBuffer as input for certain operations but fails to verify this assumption before attempting to create a typed array. An unauthenticated remote attacker can exploit this by providing specially crafted input that triggers asymmetric resource consumption (CWE-405), leading to memory exhaustion or CPU spikes. This affects any application using devalue to parse externally-supplied data. The issue is resolved in version 5.6.2 by adding proper validation for ArrayBuffer and typed array inputs.

## Affected products

- Svelte devalue >= 5.3.0, < 5.6.2
- Red Hat Red Hat Trusted Artifact Signer 1.2 1.2.2
- Red Hat Red Hat Trusted Artifact Signer 1.3 1.3.2
- Red Hat Red Hat Build of Podman Desktop 0

## Identifiers

- CVE-2026-22774
- GHSA-vw5p-8cq8-m7mv

## Timeline

- 2026-01-15: disclosed: Initial disclosure and GitHub advisory published
- 2026-01-15: patched: Version 5.6.2 released
- 2026-02-05: advisory: Red Hat published security advisory RHSA-2026:2144
- 2026-02-18: advisory: Red Hat published security advisory RHSA-2026:2926

## References

- [https://github.com/sveltejs/devalue/commit/e46afa64dd2b25aa35fb905ba5d20cea63aabbf7](https://github.com/sveltejs/devalue/commit/e46afa64dd2b25aa35fb905ba5d20cea63aabbf7)
- [https://github.com/sveltejs/devalue/releases/tag/v5.6.2](https://github.com/sveltejs/devalue/releases/tag/v5.6.2)
- [https://github.com/sveltejs/devalue/security/advisories/GHSA-vw5p-8cq8-m7mv](https://github.com/sveltejs/devalue/security/advisories/GHSA-vw5p-8cq8-m7mv)
- [https://access.redhat.com/errata/RHSA-2026:2144](https://access.redhat.com/errata/RHSA-2026:2144)
- [https://access.redhat.com/errata/RHSA-2026:2926](https://access.redhat.com/errata/RHSA-2026:2926)
- [https://access.redhat.com/security/cve/CVE-2026-22774](https://access.redhat.com/security/cve/CVE-2026-22774)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2430095](https://bugzilla.redhat.com/show_bug.cgi?id=2430095)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)