CVE-2026-42570highCWE-770

CVE-2026-42570: falha de alta gravidade em sveltejs devalue

Svelte devalue: DoS via sparse array deserialization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar devalue+ Monitorar devalue

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 0.4%
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
sveltejs · devalue
CVEs relacionadas — sveltejs devalue

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92708HIGHdevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersEPSS 0.7%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%CVE-2026-30226MEDIUMdevalue has prototype pollution in devalue.parse and devalue.unflattenEPSS 0.5%CVE-2026-123563HIGHDevalue before 5.9.3 Typed-Array Allocation Validation Bypass via parseEPSS 0.4%