devalue vulnerabilities and CVEs

Known vulnerabilities affecting devalue, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

9 vulnerabilities tracked.

8.7 The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. CVE-2026-123569 8 Nov 2026
8.7 Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU amplification by supplying… CVE-2026-123566 8 Nov 2026
8.7 Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in… CVE-2026-123565 8 Nov 2026
8.7 Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse arrays allocates… CVE-2026-123564 8 Nov 2026
8.7 Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation… CVE-2026-123563 8 Nov 2026
8.7 devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple… CVE-2026-123562 8 Nov 2026
6.3 Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into… CVE-2026-123567 8 Nov 2026
6.3 devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an… CVE-2026-123561 8 Nov 2026
2.1 Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying… CVE-2026-123568 8 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that devalue is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here