sveltejs devalue up to 5.6.1 amplification

Summaryinfo

A vulnerability classified as problematic has been found in sveltejs devalue up to 5.6.1. This issue affects some unknown processing. This manipulation causes amplification. The identification of this vulnerability is CVE-2026-22775. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in sveltejs devalue up to 5.6.1. Affected by this vulnerability is some unknown processing. The manipulation with an unknown input leads to a amplification vulnerability. The CWE definition for the vulnerability is CWE-405. The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric." As an impact it is known to affect availability. The summary by CVE is:

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.

The advisory is shared at github.com. This vulnerability is known as CVE-2026-22775 since 01/09/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1499 for this issue.

Upgrading to version 5.6.2 eliminates this vulnerability. The upgrade is hosted for download at github.com. Applying the patch 11755849fa0634ae294a15ec0aef2f43efcad7c4 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• sveltejs

Name

• devalue

Version

• 5.6.0
• 5.6.1

License

• open-source

Website

• Product: https://github.com/sveltejs/devalue/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion