sveltejs devalue vulnerabilities

CVEs per yearBy the year they were published

1. 20251
2. 20266

Newest CVEs

• CVE-2026-92708

  devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

  sveltejs · devalue

  High7.5
• CVE-2026-81176

  Svelte devalue: DoS via malformed input

  sveltejs · devalue

  Medium5.3
• CVE-2026-42570

  Svelte devalue: DoS via sparse array deserialization

  sveltejs · devalue

  High7.5
• CVE-2026-30226

  devalue has prototype pollution in devalue.parse and devalue.unflatten

  sveltejs · devalue

  Medium6.3
• CVE-2026-22775

  devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

  sveltejs · devalue

  High7.5
• CVE-2026-22774

  devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

  sveltejs · devalue

  High7.5
• CVE-2025-57820

  Svelte devalue vulnerable to prototype pollution

  sveltejs · devalue

  High7.9