CVE-2026-42570

EUVD-2026-35500
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 31%
Affected Products (NVD)
VendorProductVersion
sveltedevalue
5.6.3 ≤
𝑥
< 5.8.1
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
Red HatRed Hat Trusted Artifact Signer 1.4
1783327185 ≤
𝑥
< *
ADP
Common Weakness Enumeration
References
https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b91110792d
https://github.com/sveltejs/devalue/releases/tag/v5.8.1
https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p
https://access.redhat.com/errata/RHSA-2026:37272
https://access.redhat.com/security/cve/CVE-2026-42570
https://bugzilla.redhat.com/show_bug.cgi?id=2487050
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42570.json