JavaScript Library Vulnerability in Svelte by SvelteJS

CVE-2026-92708

What is CVE-2026-92708?

The Svelte devalue library, used for serialization, contains a vulnerability present in versions 5.1.0 through 5.9.2. This issue arises when the stringify and uneval functions handle typed arrays, serializing their entire backing ArrayBuffer instead of just the view. As a result, sensitive data such as unrelated process memory—up to 64 KB—can be exposed during serialization, leading to unauthorized access to data from other users' requests. In server-side-rendered applications like SvelteKit or Nuxt, this vulnerability can unintentionally allow the inclusion of a user's request body or Authorization headers in the HTML output without proper authentication checks. The problem persists across multiple renders and is not mitigated by existing defenses against parse/unflatten prototype pollution or denial-of-service attacks. To address this vulnerability, users should convert Node Buffer objects to Uint8Array prior to serialization. The flaw has been resolved in version 5.9.3.

References