MEDIUM5.3

GHSA-9rgm-9g3h-6x36

Svelte devalue: DoS via malformed input

Quick fix

GHSA-9rgm-9g3h-6x36 — devalue: upgrade to the fixed version with the command below.

npm install devalue@5.9.2

Details

### Impact

`devalue.parse` prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.

Applications are potentially affected if they call `devalue.parse` with untrusted data.

### Patches

The bug is fixed in `devalue@5.9.2`.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/devalue

Introduced in: 0Fixed in: 5.9.2

Fixnpm install devalue@5.9.2

References

https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36[WEB]
https://nvd.nist.gov/vuln/detail/CVE-2026-81176[ADVISORY]
https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1[WEB]
https://github.com/sveltejs/devalue[PACKAGE]
https://github.com/sveltejs/devalue/releases/tag/v5.9.2[WEB]