CVE-2026-123564— Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Quick assessment

Affected

sveltejs devalue

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Sveltejs 的 devalue 库在 1.0.0 至 5.9.3 版本（不含 5.9.3）中存在内存耗尽漏洞。该漏洞位于函数中：当处理稀疏数组时，其生成的代码在评估（evaluated）阶段会按照数组声明的长度分配内存。如果攻击者能够影响应用程序序列化的一个非常大的稀疏数组，则可在浏览器或运行时环境中通过评估该输出耗尽内存。

CVSS 7.5 · High Updated Nov 08, 2026

Possible ATT&CK Techniques 2 AI

T1068 · Exploitation for Privilege Escalation T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays

Source: CVE Program / CVE List V5

Vulnerability Description

Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates memory proportional to the array's declared length when evaluated. Attackers who can influence a very large sparse array serialized by an application can exhaust memory in the browser or runtime evaluating the output.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sveltejs	devalue	1.0.0 ~ 5.9.3	-

II. Public POCs for CVE-2026-123564

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123564

请登录查看更多情报信息。

Other References for CVE-2026-123564 (2)

https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv vendor-advisory
https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-memory-exhaustion-via-uneval-sparse-arrays third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123564

Same Patch Batch · sveltejs · 2026-11-08 · 9 CVEs total

CVE-2026-123566	7.5 HIGH	Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
CVE-2026-123569	7.5 HIGH	Devalue before 5.6.3 Denial of Service via Sparse Array Serialization
CVE-2026-123563	7.5 HIGH	Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
CVE-2026-123562	7.5 HIGH	Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123565	7.5 HIGH	Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
CVE-2026-123568	4.4 MEDIUM	Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
CVE-2026-123567	3.7 LOW	Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
CVE-2026-123561	3.7 LOW	Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

IV. Related Vulnerabilities

Same product: devalue

Same vendor: sveltejs

Same weakness: CWE-770