Memory Exhaustion in Sveltejs Devalue via Sparse Arrays

Executive Summary

CVE-2026-123564 is a memory exhaustion vulnerability in the Sveltejs devalue library before version 5.9.3. It occurs in the uneval function when handling sparse arrays. The issue causes memory allocation proportional to the array's declared length during evaluation, not its actual content. Attackers can exploit this by manipulating a large sparse array to exhaust memory in the browser or runtime processing the output.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of devalue in your project using npm list devalue or npm ls devalue. If the version is below 5.9.3, the system is vulnerable. Review application code for usage of the uneval function with sparse arrays.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause memory exhaustion in browsers or runtimes that evaluate output from the uneval function. If an application serializes very large sparse arrays and an attacker influences this data, the consuming system may run out of memory. This could crash the browser tab or application, leading to denial of service.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade devalue to version 5.9.3 or later using npm update devalue or by modifying package.json. If upgrading is not possible, avoid serializing very large sparse arrays with uneval or implement input validation to limit array sizes.

Useful 0 Not Useful 0