The sveltejs devalue library, used for serializing values into strings beyond JSON.stringify capabilities, contains a vulnerability (CWE-770) in versions >=5.6.3 and <5.8.1. Specifically, the devalue.parse function can be manipulated to allocate significantly more memory than necessary when deserializing sparse arrays, caused by quirks in certain JavaScript engines. This results in excessive memory consumption, potentially impacting availability. The issue is addressed in version 5.8.1. The Red Hat advisory confirms the vulnerability and references the fixed version but does not indicate any known exploits in the wild.

This vulnerability can cause excessive memory consumption when deserializing sparse arrays using devalue.parse in affected versions. While it does not impact confidentiality or integrity, it poses an availability risk by potentially exhausting system memory, leading to denial of service conditions in applications using the vulnerable library versions.

A fix is available in sveltejs devalue version 5.8.1. Users should upgrade to version 5.8.1 or later to remediate this vulnerability. The Red Hat advisory confirms the issue and the availability of a patch. No additional mitigation steps are indicated or required beyond applying the official fix.