# Svelte devalue CPU and memory exhaustion in sparse arrays

Source: https://junglewise.ai/threats/svelte-devalue-dos-via-sparse-array-serialization-3093799b  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-02-19. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 4 · Published 2026-02-19

Devalue is a JavaScript library used to serialize complex data structures beyond what JSON.stringify can handle. When processing specially crafted sparse arrays, devalue's uneval or stringify functions can consume excessive CPU and memory, potentially causing a denial of service. In practice, this is difficult to exploit because an attacker would need to create a sparse array on the server—which is virtually impossible through standard web protocols—and then pass it through the vulnerable serialization functions.

Technologies: [devalue (npm)](https://junglewise.ai/threats/technologies/devalue). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 4, published 19 February 2026.

**Which products and versions are affected?** devalue (npm) SEMVER:introduced=0,fixed=5.6.3.

**Is there a fix for This vulnerability?** Yes. devalue (npm): upgrade to 5.6.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devalue (npm): upgrade to 5.6.3 or later

  ```sh
  npm install devalue@5.6.3
  ```


## Technical details

This vulnerability is a denial-of-service (DoS) issue in the sparse array handling of devalue's uneval and stringify functions (CWE-770: Allocation of Resources Without Limits or Throttling). The root cause is inefficient encoding of sparse arrays that can lead to disproportionate CPU and memory consumption during serialization. The attack vector is network-based but has a high complexity bar: an attacker must somehow create a sparse array on the server-side and trigger its serialization through devalue. This is not feasible through standard wire formats (JSON, form data, etc.), making real-world exploitation extremely unlikely. When the conditions are met, an attacker can cause the server to exhaust resources and stop responding. The fix was released in devalue version 5.6.3, which implements better encoding for sparse arrays.

## Affected products

- Svelte devalue <=5.6.2

## Timeline

- 2026-02-19: disclosed

## References

- [https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm](https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm)
- [https://github.com/sveltejs/devalue/commit/819f1ac7475ab37547645cfb09bf2f678a799cf0](https://github.com/sveltejs/devalue/commit/819f1ac7475ab37547645cfb09bf2f678a799cf0)
- [https://github.com/sveltejs/devalue](https://github.com/sveltejs/devalue)
- [https://github.com/sveltejs/devalue/releases/tag/v5.6.3](https://github.com/sveltejs/devalue/releases/tag/v5.6.3)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)