CVE-2026-81176: fallo de gravedad media en sveltejs devalue
Svelte devalue: DoS via malformed input
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
sveltejs · devalueCVEs relacionadas — sveltejs devalue
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-92708HIGHdevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersEPSS 0.7%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-30226MEDIUMdevalue has prototype pollution in devalue.parse and devalue.unflattenEPSS 0.4%CVE-2026-42570HIGHSvelte devalue: DoS via sparse array deserializationEPSS 0.4%CVE-2025-57820HIGHSvelte devalue vulnerable to prototype pollutionEPSS 0.4%