Memory Exhaustion Flaw in Sveltejs Devalue Affects Sparse Arrays

CVE-2026-123564

What is CVE-2026-123564?

The devalue module in Sveltejs, up to version 5.9.2, suffers from a memory exhaustion vulnerability in its uneval function. This flaw allows attackers to generate sparse arrays whose serialized length is large, leading to excessive memory allocation when evaluated. By manipulating the input, an attacker can potentially exhaust the memory of the executing environment—be it in a browser or a runtime—resulting in performance degradation or application failure. Users of affected versions are advised to update to 5.9.3 or later to mitigate these risks.

References