# CVE-2026-81176: Svelte devalue DoS via malformed input

Source: https://junglewise.ai/threats/cve-2026-81176-svelte-devalue-dos-via-malformed-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-16. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-81176 · Severity: medium · CVSS 5.3 · Published 2026-09-16

Svelte devalue is a JavaScript library used to serialize and deserialize complex data structures. A flaw in the devalue.parse function fails to reject out-of-bounds array indices in specially-crafted payloads, causing the parser to perform quadratic-time processing. An attacker sending malformed data to an application that parses untrusted input could cause CPU exhaustion and service disruption.

Technologies: [devalue (npm)](https://junglewise.ai/threats/technologies/devalue). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-81176 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-81176 being exploited in the wild.

**How severe is CVE-2026-81176?** Medium severity, with a CVSS score of 5.3, published 16 September 2026.

**Which products and versions are affected?** devalue (npm) < 5.9.1, SEMVER:introduced=0,fixed=5.9.2.

**Is there a fix for CVE-2026-81176?** Yes. devalue (npm): upgrade to 5.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-81176 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-81176?** Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devalue (npm): upgrade to 5.9.2 or later

  ```sh
  npm install devalue@5.9.2
  ```


## Technical details

The vulnerability is a resource exhaustion flaw (CWE-770) in devalue.parse prior to version 5.9.2. The parser fails to properly validate out-of-bounds array indices, allowing attackers to craft payloads that force the parser to alternate between different array representations. This results in algorithmic complexity that scales quadratically with payload size. The attack is network-accessible with no authentication or user interaction required. An attacker can send malformed input to any application calling devalue.parse with untrusted data, causing denial of service through CPU consumption. The vulnerability is patched in devalue 5.9.2.

## Affected products

- Svelte devalue < 5.9.2

## Identifiers

- CVE-2026-81176
- GHSA-9rgm-9g3h-6x36

## Timeline

- 2026-08-27: disclosed
- 2026-09-17: patched: devalue 5.9.2 released

## References

- [https://api.github.com/users/Rich-Harris](https://api.github.com/users/Rich-Harris)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)