CVE-2026-123569— Devalue before 5.6.3 Denial of Service via Sparse Array Serialization

Quick assessment

Affected

sveltejs devalue

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

npm 的包在 5.6.3 版本之前，在使用或序列化稀疏数组时，可能会消耗过量的 CPU 和内存。如果攻击者能够在服务端构造出稀疏数组（主流数据交换格式通常不允许此类操作），并在服务端对其进行序列化，则可能导致拒绝服务（DoS）攻击。

CVSS 7.5 · High Updated Nov 08, 2026

Possible ATT&CK Techniques 1 AI

T1499 · Endpoint Denial of Service

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Devalue before 5.6.3 Denial of Service via Sparse Array Serialization

Source: CVE Program / CVE List V5

Vulnerability Description

The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An attacker who manages to get a sparse array created on the server, which mainstream wire formats do not allow, and serialized there can cause a denial of service.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

不加限制或调节的资源分配

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
sveltejs	devalue	0 ~ 5.6.3	-

II. Public POCs for CVE-2026-123569

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-123569

请登录查看更多情报信息。

Other References for CVE-2026-123569 (2)

https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm vendor-advisory
https://www.vulncheck.com/advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serialization third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-123569

Same Patch Batch · sveltejs · 2026-11-08 · 9 CVEs total

CVE-2026-123564	7.5 HIGH	Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-123566	7.5 HIGH	Devalue before 5.9.3 CPU Amplification Denial of Service via uneval
CVE-2026-123563	7.5 HIGH	Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
CVE-2026-123562	7.5 HIGH	Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123565	7.5 HIGH	Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
CVE-2026-123568	4.4 MEDIUM	Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
CVE-2026-123567	3.7 LOW	Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
CVE-2026-123561	3.7 LOW	Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion

IV. Related Vulnerabilities

Same product: devalue

Same vendor: sveltejs

Same weakness: CWE-770