Is CVE-2026-81176 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-81176 being exploited in the wild.

How severe is CVE-2026-81176?

Medium severity, with a CVSS score of 5.3, published 16 September 2026.

Which products and versions are affected?

devalue (npm) < 5.9.1, SEMVER:introduced=0,fixed=5.9.2.

Is there a fix for CVE-2026-81176?

Yes. devalue (npm): upgrade to 5.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-81176 attacked?

It is attacked over the network.

Am I affected by CVE-2026-81176?

Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81176: Svelte devalue DoS via malformed input

Q: Which products and versions are affected?

devalue (npm) < 5.9.1, SEMVER:introduced=0,fixed=5.9.2.

Q: Is there a fix for CVE-2026-81176?

Yes. devalue (npm): upgrade to 5.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-81176 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-81176?

Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-81176 · Severity: medium · CVSS 5.3 · Published 2026-09-16

Svelte devalue is a JavaScript library used to serialize and deserialize complex data structures. A flaw in the devalue.parse function fails to reject out-of-bounds array indices in specially-crafted payloads, causing the parser to perform quadratic-time processing. An attacker sending malformed data to an application that parses untrusted input could cause CPU exhaustion and service disruption.

Technologies: devalue (npm). Vendors: npm.

Quick answers

Is CVE-2026-81176 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-81176 being exploited in the wild.
How severe is CVE-2026-81176?: Medium severity, with a CVSS score of 5.3, published 16 September 2026.
Which products and versions are affected?: devalue (npm) < 5.9.1, SEMVER:introduced=0,fixed=5.9.2.
Is there a fix for CVE-2026-81176?: Yes. devalue (npm): upgrade to 5.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-81176 attacked?: It is attacked over the network.
Am I affected by CVE-2026-81176?: Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

devalue (npm): upgrade to 5.9.2 or later
```
npm install devalue@5.9.2
```

Technical details

The vulnerability is a resource exhaustion flaw (CWE-770) in devalue.parse prior to version 5.9.2. The parser fails to properly validate out-of-bounds array indices, allowing attackers to craft payloads that force the parser to alternate between different array representations. This results in algorithmic complexity that scales quadratically with payload size. The attack is network-accessible with no authentication or user interaction required. An attacker can send malformed input to any application calling devalue.parse with untrusted data, causing denial of service through CPU consumption. The vulnerability is patched in devalue 5.9.2.

Affected products

Svelte devalue < 5.9.2

Identifiers

CVE-2026-81176
GHSA-9rgm-9g3h-6x36

Timeline

2026-08-27: disclosed
2026-09-17: patched: devalue 5.9.2 released

References

https://api.github.com/users/Rich-Harris

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.