{"id":"CVE-2026-92708","aliases":["CLSA-2026-1790888210","CLSA-2026-1790888237","CLSA-2026-1790937656","CLSA-2026-1790939353","CLSA-2026-1790965180","CLSA-2026-1791626432","CLSA-2026-1791626600","CLSA-2026-1791626697","CLSA-2026-1791666589","CLSA-2026-1791666797","CLSA-2026-1791666885","CLSA-2026-1791666988","CLSA-2026-1792230898","CLSA-2026-1792230990","CLSA-2026-1792231253","CLSA-2026-1792369063","CLSA-2026-1792446921","CLSA-2026-1793098685","CLSA-2026-1793098799","EUVD-2026-83362","GHSA-4q55-j62x-fr9h","GHSA-hx4r-w6wj-j8fg","GHSA-j22f-vq7h-c4qm","GHSA-mcm9-63f2-9j32","GHSA-r9w8-h9r3-54w4","GHSA-wf3x-273g-mvxv","GHSA-x5rw-q4pp-hg5g"],"status":"published","title":"devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00725,"percentile":0.54525,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321","CWE-200","CWE-226","CWE-248","CWE-400","CWE-407","CWE-409","CWE-755","CWE-789","CWE-843"],"published":"2026-09-18T19:54:28Z","modified":"2026-10-28T02:30:24Z","fixes":[{"ecosystem":"npm","package":"devalue","fixed_in":["5.9.3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"devalue","fixed_in":["5.9.2-tuxcare.1","5.9.0-tuxcare.1","5.9.1-tuxcare.1","5.9.0-tuxcare.2","5.9.0-tuxcare.3","4.3.0-tuxcare.4","4.3.1-tuxcare.3","2.0.1-tuxcare.5","4.3.2-tuxcare.4","4.3.1-tuxcare.4","4.3.3-tuxcare.6","5.9.0-tuxcare.4","4.3.0-tuxcare.5","4.3.2-tuxcare.5","4.3.3-tuxcare.7","5.8.2-tuxcare.2","5.8.1-tuxcare.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.0"},{"last_affected":"5.9.2"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.2-tuxcare.0"},{"fixed":"5.9.2-tuxcare.1"}]}],"versions":["5.9.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0-tuxcare.0"},{"fixed":"5.9.0-tuxcare.1"}]}],"versions":["5.9.0"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.1-tuxcare.0"},{"fixed":"5.9.1-tuxcare.1"}]}],"versions":["5.9.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0-tuxcare.0"},{"fixed":"5.9.0-tuxcare.2"}]}],"versions":["5.9.0","5.9.0-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0-tuxcare.0"},{"fixed":"5.9.0-tuxcare.3"}]}],"versions":["5.9.0","5.9.0-tuxcare.1","5.9.0-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.4"}]}],"versions":["4.3.0","4.3.0-tuxcare.1","4.3.0-tuxcare.2","4.3.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-tuxcare.0"},{"fixed":"4.3.1-tuxcare.3"}]}],"versions":["4.3.1","4.3.1-tuxcare.1","4.3.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.1-tuxcare.0"},{"fixed":"2.0.1-tuxcare.5"}]}],"versions":["2.0.1","2.0.1-tuxcare.1","2.0.1-tuxcare.2","2.0.1-tuxcare.3","2.0.1-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-tuxcare.0"},{"fixed":"4.3.2-tuxcare.4"}]}],"versions":["4.3.2","4.3.2-tuxcare.1","4.3.2-tuxcare.2","4.3.2-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.1-tuxcare.0"},{"fixed":"4.3.1-tuxcare.4"}]}],"versions":["4.3.1","4.3.1-tuxcare.1","4.3.1-tuxcare.2","4.3.1-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.3-tuxcare.0"},{"fixed":"4.3.3-tuxcare.6"}]}],"versions":["4.3.3","4.3.3-tuxcare.1","4.3.3-tuxcare.2","4.3.3-tuxcare.3","4.3.3-tuxcare.4","4.3.3-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.9.0-tuxcare.0"},{"fixed":"5.9.0-tuxcare.4"}]}],"versions":["5.9.0","5.9.0-tuxcare.1","5.9.0-tuxcare.2","5.9.0-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.0-tuxcare.0"},{"fixed":"4.3.0-tuxcare.5"}]}],"versions":["4.3.0","4.3.0-tuxcare.1","4.3.0-tuxcare.2","4.3.0-tuxcare.3","4.3.0-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-tuxcare.0"},{"fixed":"4.3.2-tuxcare.5"}]}],"versions":["4.3.2","4.3.2-tuxcare.1","4.3.2-tuxcare.2","4.3.2-tuxcare.3","4.3.2-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.3-tuxcare.0"},{"fixed":"4.3.3-tuxcare.7"}]}],"versions":["4.3.3","4.3.3-tuxcare.1","4.3.3-tuxcare.2","4.3.3-tuxcare.3","4.3.3-tuxcare.4","4.3.3-tuxcare.5","4.3.3-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.2-tuxcare.0"},{"fixed":"5.8.2-tuxcare.1"}]}],"versions":["5.8.2"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.1-tuxcare.0"},{"fixed":"5.8.1-tuxcare.1"}]}],"versions":["5.8.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.2-tuxcare.0"},{"fixed":"5.8.2-tuxcare.2"}]}],"versions":["5.8.2","5.8.2-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.8.1-tuxcare.0"},{"fixed":"5.8.1-tuxcare.2"}]}],"versions":["5.8.1","5.8.1-tuxcare.1"]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"5.1.0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"5.9.3"}]}]},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"5.8.0"},{"fixed":"5.9.3"}]}]}],"products":[{"vendor":"sveltejs","product":"devalue"}],"references":[{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-4q55-j62x-fr9h","tags":["web"]},{"url":"https://github.com/sveltejs/devalue/commit/9ec513072e31f45e60d44dad6f0dba9c92bb8675","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4q55-j62x-fr9h"},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg","tags":["web"]},{"url":"https://github.com/sveltejs/devalue/commit/6861dbbb7e548849e48bce718e88747a298f7250","tags":["web"]},{"url":"https://github.com/advisories/GHSA-hx4r-w6wj-j8fg"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92708","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-j22f-vq7h-c4qm"},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32","tags":["web"]},{"url":"https://github.com/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mcm9-63f2-9j32"},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4","tags":["web"]},{"url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r9w8-h9r3-54w4"},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wf3x-273g-mvxv"},{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g","tags":["web"]},{"url":"https://github.com/sveltejs/devalue/commit/dae8153e9d7541b975cc4018138d6cebec6c1199","tags":["web"]},{"url":"https://github.com/advisories/GHSA-x5rw-q4pp-hg5g"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92708.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-92708","title":"devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.","status":"published","published":"2026-09-18T19:54:28.335Z","modified":"2026-09-23T19:38:36.551Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200","CWE-226"],"updated_at":"2026-11-02T13:48:24.536396Z"}],"euvd":[{"id":"EUVD-2026-83362","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.","status":"published","published":"2026-09-18T19:54:28Z","modified":"2026-09-23T19:38:36Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T17:27:59.820483Z"}],"ghsa":[{"id":"GHSA-4q55-j62x-fr9h","title":"devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion","description":"This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause `parse` to create objects with a `__proto__` own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how `JSON.parse` works, but we decided to be a little more defensive here and not allow the creation of objects with `__proto__` own-properties. It is very unlikely for this to cause any issues.","status":"published","published":"2026-10-01T15:13:23Z","modified":"2026-10-01T15:13:25Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:23.783773Z"},{"id":"GHSA-hx4r-w6wj-j8fg","title":"devalue: Residual sparse-array CPU amplification in uneval","description":"`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.","status":"published","published":"2026-10-01T15:17:42Z","modified":"2026-10-01T15:17:43Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-j22f-vq7h-c4qm","title":"devalue: `stringify`/`uneval` serialize shared memory","description":"### Impact\n\n`stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. In the case of a Node `Buffer` object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node `Buffer` the backing store is Node's **process-wide shared pool**, so serializing a small `Buffer` copies up to 64 KB of unrelated process memory — including bytes from other in-flight requests — into the output. In an SSR framework (SvelteKit, Nuxt) a public page whose `load()` returns a 2-byte `Buffer`, or a small file read with `readFileSync`, ships another user's request body / `Authorization` header in its HTML. Unauthenticated, silent, ~43,000× amplification.\n\nThis is serialization-side, so the `parse`/`unflatten` prototype-pollution and DoS guards do not apply — it fires on every SSR render, not only when parsing untrusted input.\n\n### Workarounds\n\nConvert Node `Buffer` objects to `Uint8Array`:\n\n```diff\npayload = {\n- buffer\n+ buffer: new Uint8Array(buffer)\n}\n```","status":"published","published":"2026-10-01T15:18:06Z","modified":"2026-10-01T15:18:07Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-226"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-mcm9-63f2-9j32","title":"devalue: Repeated primitive strings cause quadratic expansion in uneval","description":"Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.","status":"published","published":"2026-10-01T15:17:29Z","modified":"2026-10-01T15:17:30Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-r9w8-h9r3-54w4","title":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","description":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","status":"published","published":"2026-10-01T15:15:56Z","modified":"2026-10-17T05:04:12Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-789","CWE-843"],"updated_at":"2026-11-02T14:41:32.483482Z"},{"id":"GHSA-wf3x-273g-mvxv","title":"devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated","description":"Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default `parse` sparse-array construction.\n\nYou would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for `uneval` of sending data to the client, the worst that could happen is the browser tab running out of memory.","status":"published","published":"2026-10-01T15:17:13Z","modified":"2026-10-01T15:17:16Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L","level":"low"}],"cwes":["CWE-400","CWE-789"],"updated_at":"2026-11-02T14:41:24.739884Z"},{"id":"GHSA-x5rw-q4pp-hg5g","title":"devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise","description":"When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.\n\nThis is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.","status":"published","published":"2026-10-01T15:15:13Z","modified":"2026-10-01T15:15:15Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248","CWE-755"],"updated_at":"2026-11-02T14:41:24.739884Z"}],"nvd":[{"id":"CVE-2026-92708","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.","status":"published","published":"2026-09-18T20:17:30.15Z","modified":"2026-09-23T20:17:22.253Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-200","CWE-226"],"updated_at":"2026-11-02T14:12:50.043898Z"}],"osv":[{"id":"CVE-2026-92708","title":"devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.","status":"published","published":"2026-09-18T19:54:28.335Z","modified":"2026-10-28T02:30:24.36770782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-226"],"updated_at":"2026-11-02T15:45:20.588039Z"},{"id":"GHSA-4q55-j62x-fr9h","title":"devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion","description":"This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause `parse` to create objects with a `__proto__` own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how `JSON.parse` works, but we decided to be a little more defensive here and not allow the creation of objects with `__proto__` own-properties. It is very unlikely for this to cause any issues.","status":"published","published":"2026-10-01T15:13:23Z","modified":"2026-11-08T10:56:13.48492765Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"GHSA-hx4r-w6wj-j8fg","title":"devalue: Residual sparse-array CPU amplification in uneval","description":"`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker-influenced sparse values to `uneval` can suffer event-loop blocking. Since attacker-controlled creation of sparse arrays is so difficult, this vulnerability is very difficult to exploit.","status":"published","published":"2026-10-01T15:17:42Z","modified":"2026-11-08T10:56:11.387612861Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-400","CWE-407"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"GHSA-j22f-vq7h-c4qm","title":"devalue: `stringify`/`uneval` serialize shared memory","description":"### Impact\n\n`stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. In the case of a Node `Buffer` object, the backing buffer is a process-wide shared pool, meaning unrelated memory can be serialized into a response that is then sent to the client. For a Node `Buffer` the backing store is Node's **process-wide shared pool**, so serializing a small `Buffer` copies up to 64 KB of unrelated process memory — including bytes from other in-flight requests — into the output. In an SSR framework (SvelteKit, Nuxt) a public page whose `load()` returns a 2-byte `Buffer`, or a small file read with `readFileSync`, ships another user's request body / `Authorization` header in its HTML. Unauthenticated, silent, ~43,000× amplification.\n\nThis is serialization-side, so the `parse`/`unflatten` prototype-pollution and DoS guards do not apply — it fires on every SSR render, not only when parsing untrusted input.\n\n### Workarounds\n\nConvert Node `Buffer` objects to `Uint8Array`:\n\n```diff\npayload = {\n- buffer\n+ buffer: new Uint8Array(buffer)\n}\n```","status":"published","published":"2026-10-01T15:18:06Z","modified":"2026-10-01T15:30:12.678757365Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-226"],"updated_at":"2026-11-02T15:46:49.621585Z"},{"id":"GHSA-mcm9-63f2-9j32","title":"devalue: Repeated primitive strings cause quadratic expansion in uneval","description":"Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into a very large serialized string.","status":"published","published":"2026-10-01T15:17:29Z","modified":"2026-11-08T10:56:13.292191726Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400","CWE-409"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"GHSA-r9w8-h9r3-54w4","title":"devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation","description":"Under very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.","status":"published","published":"2026-10-01T15:15:56Z","modified":"2026-11-08T10:56:12.205727459Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-789","CWE-843"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"GHSA-wf3x-273g-mvxv","title":"devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated","description":"Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny serialized value can therefore cause large memory allocation in a consuming browser/runtime. This occurs during evaluation of generated code, not in default `parse` sparse-array construction.\n\nYou would only be affected by this if you were serializing very large sparse arrays and then evaluating the results. In the general use case for `uneval` of sending data to the client, the worst that could happen is the browser tab running out of memory.","status":"published","published":"2026-10-01T15:17:13Z","modified":"2026-11-08T10:56:08.686140515Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:L","level":"low"}],"cwes":["CWE-400","CWE-789"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"GHSA-x5rw-q4pp-hg5g","title":"devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise","description":"When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promise remains unhandled even if the caller catches the returned `stringifyAsync` promise. Under Node's default unhandled-rejection behavior this can terminate the process. Applications whose asynchronous failures/timing can be influenced by requests are potentially exposed.\n\nThis is essentially impossible to exploit, and is much more likely to surface as a developer-introduced bug.","status":"published","published":"2026-10-01T15:15:13Z","modified":"2026-11-08T10:56:11.899025413Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-248","CWE-755"],"updated_at":"2026-11-08T11:04:05.022583Z"},{"id":"CLSA-2026-1790888210","title":"TuxCare security update for devalue (5 CVEs)","description":"TuxCare rebuilt devalue to address 5 CVEs. Fixed in 5.9.2-tuxcare.1.","status":"published","published":"2026-10-01T20:56:50Z","modified":"2026-10-15T09:47:57.835233112Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790888237","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.1.","status":"published","published":"2026-10-01T20:57:17Z","modified":"2026-10-15T09:47:57.773925881Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1790937656","title":"TuxCare security update for devalue (4 CVEs)","description":"TuxCare rebuilt devalue to address 4 CVEs. Fixed in 5.9.1-tuxcare.1.","status":"published","published":"2026-10-02T10:40:56Z","modified":"2026-10-15T09:47:38.712239891Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790939353","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.2.","status":"published","published":"2026-10-02T11:09:13Z","modified":"2026-10-15T09:47:38.796309643Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1790965180","title":"TuxCare security update for devalue (3 CVEs)","description":"TuxCare rebuilt devalue to address 3 CVEs. Fixed in 5.9.0-tuxcare.3.","status":"published","published":"2026-10-02T18:19:40Z","modified":"2026-10-15T09:47:57.93250983Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1791626432","title":"TuxCare security update for devalue (3 CVEs)","description":"TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.0-tuxcare.4.","status":"published","published":"2026-10-10T10:00:32Z","modified":"2026-10-15T09:48:04.526595791Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791626600","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.1-tuxcare.3.","status":"published","published":"2026-10-10T10:03:20Z","modified":"2026-10-15T09:48:04.41939228Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791626697","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 2.0.1-tuxcare.5.","status":"published","published":"2026-10-10T10:04:57Z","modified":"2026-10-15T09:48:04.500524882Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791666589","title":"TuxCare security update for devalue (3 CVEs)","description":"TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.2-tuxcare.4.","status":"published","published":"2026-10-10T21:09:49Z","modified":"2026-10-15T09:46:04.087648378Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791666797","title":"TuxCare security update for devalue (3 CVEs)","description":"TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.1-tuxcare.4.","status":"published","published":"2026-10-10T21:13:17Z","modified":"2026-10-15T09:46:03.462393862Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791666885","title":"TuxCare security update for devalue (3 CVEs)","description":"TuxCare rebuilt devalue to address 3 CVEs. Fixed in 4.3.3-tuxcare.6.","status":"published","published":"2026-10-10T21:14:45Z","modified":"2026-10-15T09:47:39.815849456Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791666988","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.9.0-tuxcare.4.","status":"published","published":"2026-10-10T21:16:28Z","modified":"2026-10-15T09:47:39.733577699Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792230898","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.0-tuxcare.5.","status":"published","published":"2026-10-17T09:54:58Z","modified":"2026-10-17T13:09:26.590895505Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792230990","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.2-tuxcare.5.","status":"published","published":"2026-10-17T09:56:30Z","modified":"2026-10-17T13:09:27.750954618Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792231253","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 4.3.3-tuxcare.7.","status":"published","published":"2026-10-17T10:00:53Z","modified":"2026-10-17T13:09:28.211122064Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792369063","title":"TuxCare security update for devalue (7 CVEs)","description":"TuxCare rebuilt devalue to address 7 CVEs. Fixed in 5.8.2-tuxcare.1.","status":"published","published":"2026-10-19T00:17:43Z","modified":"2026-10-27T01:57:58.381579784Z","updated_at":"2026-11-02T15:43:53.353888Z"},{"id":"CLSA-2026-1792446921","title":"TuxCare security update for devalue (6 CVEs)","description":"TuxCare rebuilt devalue to address 6 CVEs. Fixed in 5.8.1-tuxcare.1.","status":"published","published":"2026-10-19T21:55:21Z","modified":"2026-10-20T01:45:09.151328908Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1793098685","title":"TuxCare security update for devalue (1 CVE)","description":"TuxCare rebuilt devalue to address 1 CVE. Fixed in 5.8.2-tuxcare.2.","status":"published","published":"2026-10-27T10:58:05Z","modified":"2026-10-27T13:30:16.647090305Z","updated_at":"2026-11-02T15:43:55.34846Z"},{"id":"CLSA-2026-1793098799","title":"TuxCare security update for devalue (2 CVEs)","description":"TuxCare rebuilt devalue to address 2 CVEs. Fixed in 5.8.1-tuxcare.2.","status":"published","published":"2026-10-27T10:59:59Z","modified":"2026-10-27T13:30:09.259175657Z","updated_at":"2026-11-02T15:43:55.34846Z"}]}}