Vulnerability Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Svelte | Devalue | >= 5.6.3, < 5.8.1 |
Related Weaknesses (CWE)
References
- https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b911107Patch
- https://github.com/sveltejs/devalue/releases/tag/v5.8.1ProductRelease Notes
- https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3pVendor Advisory
- https://access.redhat.com/errata/RHSA-2026:37272
- https://access.redhat.com/errata/RHSA-2026:57590
- https://access.redhat.com/security/cve/CVE-2026-42570
- https://bugzilla.redhat.com/show_bug.cgi?id=2487050
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42570.json
FAQ
What is CVE-2026-42570?
CVE-2026-42570 is a vulnerability with a CVSS score of 7.5 (HIGH). Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to qui...
How severe is CVE-2026-42570?
CVE-2026-42570 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-42570?
Check the references section above for vendor advisories and patch information. Affected products include: Svelte Devalue.