Executive brief
A vulnerability in the Svelte 'devalue' library, which is used to serialize and deserialize JavaScript data, can be exploited to cause a denial-of-service (DoS) condition. By providing specially crafted data, an attacker can force the application to consume excessive amounts of memory, potentially crashing the service or making it unresponsive. This affects applications that use devalue to process untrusted user input.
Technical details
The 'devalue.parse' function in Svelte's devalue library is vulnerable to a resource exhaustion issue (CWE-770). Due to specific behaviors in certain JavaScript engines, the deserialization of sparse arrays can be manipulated to allocate significantly more memory than required. An unauthenticated remote attacker can exploit this by sending a malicious payload containing a sparse array, leading to a Denial of Service (DoS) through memory exhaustion. The issue is fixed in version 5.8.1.
Affected products
- Svelte devalue >= 5.6.3, <= 5.8.0
Timeline
- 2026-05-14: disclosed
- 2026-05-14: advisory
- 2026-05-14: patched
References
- https://api.github.com/users/elliott-with-the-longest-name-on-github
- https://github.com/elliott-with-the-longest-name-on-github
- https://api.github.com/users/elliott-with-the-longest-name-on-github/gists%7B/gist_id%7D
- https://api.github.com/users/elliott-with-the-longest-name-on-github/repos
- https://avatars.githubusercontent.com/u/76245373?v=4
- https://api.github.com/users/elliott-with-the-longest-name-on-github/events%7B/privacy%7D