Junglewise Threat Intelligence

CVE-2026-22775: Svelte devalue denial of service via resource exhaustion in parse

CVE-2026-22775 · Severity: high · CVSS 7.5 · Published 2026-01-15

Technologies: Red Hat Build of Podman Desktop - Tech Preview, devalue (npm), Red Hat Trusted Artifact Signer. Vendors: Red Hat, npm, Svelte.

Executive brief

Svelte devalue is a software library used by developers to convert complex data into strings for storage or transmission. A vulnerability in this library allows an attacker to send specially crafted data that causes the system to consume excessive processor power and memory. This can lead to a denial-of-service (DoS) condition, making the affected application or service unavailable to legitimate users.

Technical details

A resource exhaustion vulnerability exists in Svelte devalue's 'devalue.parse' function. The root cause is located in the ArrayBuffer hydration logic, which expects base64 encoded strings as input but fails to validate this assumption before attempting to decode the data. An unauthenticated remote attacker can provide specially crafted inputs that trigger disproportionate CPU and memory consumption, leading to a denial-of-service (DoS) state. The vulnerability also includes fixes for self-referential stack overflows. This issue is resolved in version 5.6.2.

Affected products

  • Svelte devalue >= 5.1.0, < 5.6.2
  • Red Hat Red Hat Trusted Artifact Signer 1.2, 1.3
  • Red Hat Red Hat Build of Podman Desktop - Tech Preview 0

Timeline

  • 2026-01-15: disclosed: Initial disclosure and GitHub advisory published
  • 2026-01-15: patched: Version 5.6.2 released to address the vulnerability
  • 2026-01-15: advisory: GHSA-g2pg-6438-jwpf published
  • 2026-02-05: advisory: Red Hat security advisory RHSA-2026:2144 issued

References

Related threats