Denial of Service Vulnerability in Svelte Devalue Library

CVE-2026-81176

What is CVE-2026-81176?

The Svelte devalue library, designed for serializing JavaScript values, is susceptible to a vulnerability that allows for denial of service attacks. The issue arises from the devalue.parse function, which fails to adequately reject out-of-bounds indices. This allows an attacker to supply a carefully crafted payload that causes the parser to switch between array representations, resulting in excessive computational work as the payload size increases. This vulnerability has been addressed in version 5.9.2 of the devalue library.

References