CVE-2026-42570: Svelte devalue: DoS via sparse array deserialization
devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.
Other sources
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/devalueto a version that resolves this vulnerability.Fixed in 5.8.1 - Upgrade
Upgrade
Svelte devalue (devalue.parse)to a version that resolves this vulnerability.Fixed in 5.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-42570?
CVE-2026-42570 has a severity rating of high, with a score of 7.5.
What is CVE-2026-42570 about?
CVE-2026-42570 pertains to a denial of service (DoS) vulnerability in the Svelte devalue library caused by excessive memory consumption during sparse array deserialization.
How do I fix CVE-2026-42570?
To address CVE-2026-42570, upgrade the Svelte devalue library to version 5.8.1 or higher.
What software is affected by CVE-2026-42570?
CVE-2026-42570 affects the npm/devalue and Svelte devalue Node.js libraries.
What could be the impact of exploiting CVE-2026-42570?
Exploiting CVE-2026-42570 can lead to denial of service due to excessive memory allocation.