Validation Bypass Vulnerability in Devalue by Svelte
CVE-2026-123563

8.7HIGH

Key Information:

Vendor

Sveltejs

Status
Devalue
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123563?

The validation bypass flaw in Devalue versions prior to 5.9.3 enables attackers to exploit custom ArrayBuffer revivers, bypassing the allocation checks in the parse function. By supplying specially crafted inputs, adversaries can allocate disproportionately large ArrayBuffers, leading to significant memory exhaustion and potential denial of service. This vulnerability highlights the importance of robust input validation to ensure application security and stability.

Affected Version(s)

devalue 0 < 5.9.3

devalue 5.9.3

References

https://github.com/sveltejs/devalue/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/devalue-before-5.9.3...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elliott-with-the-longest-name-on-github
.