CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Svelte devalue: DoS via sparse array deserialization
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
- Record
CVE-2026-42570- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-35500
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
- Record
EUVD-2026-35500- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-77vg-94rm-hx3p
Svelte devalue: DoS via sparse array deserialization
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.
- Record
GHSA-77vg-94rm-hx3p- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
NVD
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
- Record
CVE-2026-42570- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSV
Svelte devalue: DoS via sparse array deserialization
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
- Record
CVE-2026-42570- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
OSVGHSA-77vg-94rm-hx3p
Svelte devalue: DoS via sparse array deserialization
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.
- Record
GHSA-77vg-94rm-hx3p- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-770
- Updated
- 2026-11-02
Show 5 moreShow less
OSVRHSA-2026:57590
Red Hat Security Advisory: rh-podman-desktop security, bug fix, and enhancement update
- Record
RHSA-2026:57590- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1778805970 No score
TuxCare security update for devalue (1 CVE)
TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.4.
- Record
CLSA-2026-1778805970- Updated
- 2026-11-02
OSVCLSA-2026-1790161447 No score
TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.2-tuxcare.3.
- Record
CLSA-2026-1790161447- Updated
- 2026-11-02
OSVCLSA-2026-1790605435 No score
TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.0-tuxcare.2.
- Record
CLSA-2026-1790605435- Updated
- 2026-11-02
OSVCLSA-2026-1790606671 No score
TuxCare security update for devalue (2 CVEs)
TuxCare rebuilt devalue to address 2 CVEs. Fixed in 4.3.1-tuxcare.2.
- Record
CLSA-2026-1790606671- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
devaluenpm |
5.6.3 to 5.8.0 | 5.8.1 |
devalueTuxCare:npm |
4.3.3-tuxcare.0 up to 4.3.3-tuxcare.4, plus listed versions 4.3.34.3.3-tuxcare.14.3.3-tuxcare.24.3.3-tuxcare.3 |
4.3.3-tuxcare.4 |
devalueTuxCare:npm From an advisory covering 2 CVEs |
4.3.2-tuxcare.0 up to 4.3.2-tuxcare.3, plus listed versions 4.3.24.3.2-tuxcare.14.3.2-tuxcare.2 |
4.3.2-tuxcare.3 |
devalueTuxCare:npm From an advisory covering 2 CVEs |
4.3.0-tuxcare.0 up to 4.3.0-tuxcare.2, plus listed versions 4.3.04.3.0-tuxcare.1 |
4.3.0-tuxcare.2 |
devalueTuxCare:npm From an advisory covering 2 CVEs |
4.3.1-tuxcare.0 up to 4.3.1-tuxcare.2, plus listed versions 4.3.14.3.1-tuxcare.1 |
4.3.1-tuxcare.2 |
devaluenpm |
5.6.3 up to 5.8.1 | 5.8.1 |
rh-podman-desktopRed Hat:enterprise_linux:10.2 From an advisory covering 24 CVEs |
before 0:1.1.2-1.el10_2 | 0:1.1.2-1.el10_2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-42570 is a high vulnerability (CVSS 7.5) in Svelte Devalue, published May 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in devalue 5.8.1.
References
github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p
access.redhat.com/security/cve/CVE-2026-42570
bugzilla.redhat.com/show_bug.cgi?id=2487050
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42570.json
Show 168 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-42570
issues.redhat.com/browse/RHEL-238929
cve.org/CVERecord?id=CVE-2026-9595
cna.openjsf.org/security-advisories.html
cwe.mitre.org/data/definitions/93.html
html.spec.whatwg.org/multipage/form-control-infrastructure.html
npmjs.com/package/form-data
pkg.go.dev/github.com/go-jose/go-jose/v4
raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2026/va-26-177-01.json