Executive brief
Svelte devalue is a JavaScript library used to serialize and deserialize complex data structures. A flaw in the devalue.parse function fails to reject out-of-bounds array indices in specially-crafted payloads, causing the parser to perform quadratic-time processing. An attacker sending malformed data to an application that parses untrusted input could cause CPU exhaustion and service disruption.
Technical details
The vulnerability is a resource exhaustion flaw (CWE-770) in devalue.parse prior to version 5.9.2. The parser fails to properly validate out-of-bounds array indices, allowing attackers to craft payloads that force the parser to alternate between different array representations. This results in algorithmic complexity that scales quadratically with payload size. The attack is network-accessible with no authentication or user interaction required. An attacker can send malformed input to any application calling devalue.parse with untrusted data, causing denial of service through CPU consumption. The vulnerability is patched in devalue 5.9.2.
Affected products
- Svelte devalue < 5.9.2
Timeline
- 2026-08-27: disclosed
- 2026-09-17: patched: devalue 5.9.2 released