The sveltejs devalue library versions 5.3.0 to 5.6.1 contain an asymmetric resource consumption vulnerability (CWE-405) in the devalue.parse function. When processing certain crafted inputs, the function can consume excessive CPU time and memory due to the typed array hydration expecting an ArrayBuffer input without validating this assumption. This flaw can be exploited to cause denial of service in systems that parse input from untrusted sources. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only. The issue is resolved in version 5.6.2.

Exploitation of this vulnerability can lead to denial of service by causing the devalue.parse function to consume excessive CPU and memory resources. This impacts the availability of applications using vulnerable versions of the devalue library when parsing untrusted input. There is no impact on confidentiality or integrity. No known exploits are reported in the wild at this time.

An official fix is available in sveltejs devalue version 5.6.2. Users should upgrade to version 5.6.2 or later to remediate this vulnerability. Since this is not a cloud service, remediation requires updating the affected library in the application. Patch status is confirmed by the vendor advisory. No additional mitigations are specified.