Denial of Service Vulnerability in Sveltejs Product by Svelte
CVE-2026-123566

8.7HIGH

Key Information:

Vendor

Sveltejs

Status
Devalue
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123566?

Sveltejs devalue versions prior to 5.9.3 are susceptible to a denial of service vulnerability. This issue allows an attacker to exploit the uneval function by supplying sparse arrays, leading to increased CPU usage as the system handles synchronous work relative to the declared array length. This behavior can effectively block the event loop, potentially resulting in service disruptions.

Affected Version(s)

devalue 0 < 5.9.3

devalue 5.9.3

References

https://github.com/sveltejs/devalue/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/devalue-before-5.9.3...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elliott-with-the-longest-name-on-github
.