CVE-2026-81176: CWE-770: Allocation of Resources Without Limits or Throttling in sveltejs devalue
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.
AI Analysis
Technical Summary
Svelte devalue is a JavaScript library used for serializing values into strings beyond JSON.stringify capabilities. Versions before 5.9.2 contain a vulnerability (CWE-770) where devalue.parse does not reject indices that are out-of-bounds (greater than or equal to values.length) in src/parse.js. An attacker can exploit this by crafting payloads that cause the parser to alternate between array representations, resulting in quadratic computational complexity as the payload size increases. This leads to denial of service conditions in applications processing untrusted devalue data. The vulnerability is fixed in version 5.9.2.
Potential Impact
The vulnerability allows denial of service by causing the parser to perform excessive work, potentially slowing down or crashing applications that parse untrusted devalue data. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to sveltejs devalue version 5.9.2 or later where this issue is fixed. No other mitigation is indicated or required.
CVE-2026-81176: CWE-770: Allocation of Resources Without Limits or Throttling in sveltejs devalue
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.
CVSS v3.1
Score 5.3medium
Affected software
sveltejs
devalue
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Svelte devalue is a JavaScript library used for serializing values into strings beyond JSON.stringify capabilities. Versions before 5.9.2 contain a vulnerability (CWE-770) where devalue.parse does not reject indices that are out-of-bounds (greater than or equal to values.length) in src/parse.js. An attacker can exploit this by crafting payloads that cause the parser to alternate between array representations, resulting in quadratic computational complexity as the payload size increases. This leads to denial of service conditions in applications processing untrusted devalue data. The vulnerability is fixed in version 5.9.2.
Potential Impact
The vulnerability allows denial of service by causing the parser to perform excessive work, potentially slowing down or crashing applications that parse untrusted devalue data. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Upgrade to sveltejs devalue version 5.9.2 or later where this issue is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-26T16:26:08.967Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aaae43755bf5e2cf50475e9
Added to database: 09/16/2026, 18:47:19 UTC
Last enriched: 09/16/2026, 19:01:35 UTC
Last updated: 09/16/2026, 22:11:10 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.