Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-92708— devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Quick assessment

Affected
sveltejs devalue
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Svelte 的 devalue 是一个 JavaScript 库，当 不足以完成任务时，它可以将值序列化为字符串。在 5.1.0 至 5.9.2 版本中， 和 函数在序列化类型化数组时，会输出其底层 ArrayBuffer 的完整内容，而不是仅输出视图部分。因此，当序列化 Node.js 中的 （其底层存储是进程级共享池）时，可能会泄露多达 64 KB 的无关进程内存，其中包括来自其他并发请求的字节数据。 在 SvelteKit 或 Nuxt 等服务端渲染框架中，一个公开页面如果其 函数返回一个小型 ，或者读取一

CVSS 7.5 · High

Possible ATT&CK Techniques 2 AI

T1079 T1133 · External Remote Services
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-92708

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Source: CVE Program / CVE List V5
Vulnerability Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
sveltejs devalue >= 5.1.0, < 5.9.3 -

II. Public POCs for CVE-2026-92708

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-92708

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-92708 (1)

Other References for CVE-2026-92708 (2)

IV. Related Vulnerabilities

Same product: devalue
Same vendor: sveltejs
Same weakness: CWE-200

V. Comments for CVE-2026-92708

No comments yet

Leave a comment