Denial of Service Vulnerability in Devalue Package for NPM
CVE-2026-123569

8.7HIGH

Key Information:

Vendor

Sveltejs

Status
Devalue
Vendor
CVE Published:
8 November 2026

What is CVE-2026-123569?

The devalue package for npm versions before 5.6.3 contains a vulnerability that allows for denial of service attacks through excessive CPU and memory consumption. This occurs when an attacker crafts a sparse array and manipulates serialization operations using methods such as uneval or stringify. When deployed on the server, this can lead to application instability, as mainstream wire formats do not support the serialization of such arrays, making it possible for an attacker to render services unresponsive, thereby impacting overall system performance.

Affected Version(s)

devalue 0 < 5.6.3

devalue 5.6.3

References

https://github.com/sveltejs/devalue/security/advisories/G...
vendor-advisory
https://www.vulncheck.com/advisories/devalue-before-5.6.3...
third-party-advisory

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

elliott-with-the-longest-name-on-github
.