CVE-2026-92708: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in sveltejs devalue
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
AI Analysis
Technical Summary
The vulnerability in sveltejs devalue affects versions 5.1.0 through 5.9.2. The stringify and uneval functions serialize typed arrays by emitting their entire backing ArrayBuffer rather than just the view. When serializing a Node Buffer, whose backing store is a shared process-wide pool, this results in leaking up to 64 KB of unrelated process memory. In server-side rendered frameworks like SvelteKit or Nuxt, this can cause sensitive data from other users' requests to be included in the HTML response without authentication. This exposure occurs during serialization and is not mitigated by existing parse/unflatten guards. The issue is resolved in version 5.9.3 by correcting the serialization behavior.
Potential Impact
This vulnerability allows an attacker to gain unauthorized access to sensitive information from other users' requests, such as request bodies or authorization headers, by exploiting the serialization flaw in Node Buffer objects. This can lead to information disclosure in server-side rendered applications using affected versions of devalue, potentially compromising user privacy and security.
Mitigation Recommendations
Upgrade to sveltejs devalue version 5.9.3 or later, where the vulnerability has been fixed. As a temporary workaround, convert Node Buffer objects to Uint8Array before serialization to avoid leaking unrelated process memory. No other mitigations are indicated.
CVE-2026-92708: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in sveltejs devalue
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
CVSS v3.1
Score 7.5high
Affected software
sveltejs
devalue
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in sveltejs devalue affects versions 5.1.0 through 5.9.2. The stringify and uneval functions serialize typed arrays by emitting their entire backing ArrayBuffer rather than just the view. When serializing a Node Buffer, whose backing store is a shared process-wide pool, this results in leaking up to 64 KB of unrelated process memory. In server-side rendered frameworks like SvelteKit or Nuxt, this can cause sensitive data from other users' requests to be included in the HTML response without authentication. This exposure occurs during serialization and is not mitigated by existing parse/unflatten guards. The issue is resolved in version 5.9.3 by correcting the serialization behavior.
Potential Impact
This vulnerability allows an attacker to gain unauthorized access to sensitive information from other users' requests, such as request bodies or authorization headers, by exploiting the serialization flaw in Node Buffer objects. This can lead to information disclosure in server-side rendered applications using affected versions of devalue, potentially compromising user privacy and security.
Mitigation Recommendations
Upgrade to sveltejs devalue version 5.9.3 or later, where the vulnerability has been fixed. As a temporary workaround, convert Node Buffer objects to Uint8Array before serialization to avoid leaking unrelated process memory. No other mitigations are indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-16T16:22:31.542Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6aad98c355bf5e2cf57b8890
Added to database: 09/18/2026, 20:02:11 UTC
Last enriched: 09/18/2026, 20:17:57 UTC
Last updated: 09/19/2026, 00:09:47 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.