Is CVE-2026-22775 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-22775 being exploited in the wild.

How severe is CVE-2026-22775?

High severity, with a CVSS score of 7.5, published 15 January 2026.

Which products and versions are affected?

devalue (npm) SEMVER:introduced=5.1.0,fixed=5.6.2; Red Hat Build of Podman Desktop - Tech Preview 0; Red Hat Trusted Artifact Signer 1.2, 1.3.

Is there a fix for CVE-2026-22775?

Yes. devalue (npm): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-22775 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-22775?

Check whether you run devalue (npm), Red Hat Build of Podman Desktop - Tech Preview or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-22775: Svelte devalue denial of service via resource exhaustion in parse

CVE-2026-22775 · Severity: high · CVSS 7.5 · Published 2026-01-15

Svelte devalue is a software library used by developers to convert complex data into strings for storage or transmission. A vulnerability in this library allows an attacker to send specially crafted data that causes the system to consume excessive processor power and memory. This can lead to a denial-of-service (DoS) condition, making the affected application or service unavailable to legitimate users.

Technologies: devalue (npm), Red Hat Build of Podman Desktop - Tech Preview, Red Hat Trusted Artifact Signer. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-22775 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-22775 being exploited in the wild.
How severe is CVE-2026-22775?: High severity, with a CVSS score of 7.5, published 15 January 2026.
Which products and versions are affected?: devalue (npm) SEMVER:introduced=5.1.0,fixed=5.6.2; Red Hat Build of Podman Desktop - Tech Preview 0; Red Hat Trusted Artifact Signer 1.2, 1.3.
Is there a fix for CVE-2026-22775?: Yes. devalue (npm): upgrade to 5.6.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-22775 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-22775?: Check whether you run devalue (npm), Red Hat Build of Podman Desktop - Tech Preview or Red Hat Trusted Artifact Signer at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

devalue (npm): upgrade to 5.6.2 or later
```
npm install devalue@5.6.2
```

Technical details

A resource exhaustion vulnerability exists in Svelte devalue's 'devalue.parse' function. The root cause is located in the ArrayBuffer hydration logic, which expects base64 encoded strings as input but fails to validate this assumption before attempting to decode the data. An unauthenticated remote attacker can provide specially crafted inputs that trigger disproportionate CPU and memory consumption, leading to a denial-of-service (DoS) state. The vulnerability also includes fixes for self-referential stack overflows. This issue is resolved in version 5.6.2.

Affected products

Svelte devalue >= 5.1.0, < 5.6.2
Red Hat Red Hat Trusted Artifact Signer 1.2, 1.3
Red Hat Red Hat Build of Podman Desktop - Tech Preview 0

Identifiers

CVE-2026-22775
GHSA-g2pg-6438-jwpf

Timeline

2026-01-15: disclosed: Initial disclosure and GitHub advisory published
2026-01-15: patched: Version 5.6.2 released to address the vulnerability
2026-01-15: advisory: GHSA-g2pg-6438-jwpf published
2026-02-05: advisory: Red Hat security advisory RHSA-2026:2144 issued

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.