Denial of Service in Sveltejs Devalue via Sparse Arrays

Executive Summary

CVE-2026-123566 is a denial of service vulnerability in the devalue library before version 5.9.3. It allows attackers to cause CPU amplification by passing sparse arrays to the uneval function. This forces the event loop to perform synchronous work proportional to the array's declared length, consuming excessive CPU resources and blocking the event loop.

Useful 0 Not Useful 0

Detection Guidance

Check the installed version of the devalue library using npm list devalue. If the version is below 5.9.3, the system is vulnerable. Monitor CPU usage for unexpected spikes during JavaScript processing, particularly when handling sparse arrays.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to severe performance degradation or complete denial of service in applications using affected versions of devalue. It may cause high CPU usage, unresponsive systems, or crashes, disrupting normal operations and user experience.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the devalue library to version 5.9.3 or later using npm update devalue. If immediate upgrade is not possible, restrict input handling for sparse arrays in JavaScript applications to prevent event-loop blocking.

Useful 0 Not Useful 0