Product by Sveltejs
Devalue
16 known vulnerabilities in Devalue (Sveltejs), 0 of them actively exploited (CISA KEV).
Key figures
16
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-92708 | devalue: `stringify`/`uneval` serialize shared memory | 7.5 | |
| High | CVE-2026-123563 | Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse | 7.5 | |
| High | CVE-2026-123569 | Devalue before 5.6.3 Denial of Service via Sparse Array Serialization | 7.5 | |
| High | CVE-2026-123566 | Devalue before 5.9.3 CPU Amplification Denial of Service via uneval | 7.5 | |
| High | CVE-2026-123565 | Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval | 7.5 | |
| High | CVE-2026-123564 | Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays | 7.5 | |
| High | CVE-2026-123562 | Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection | 7.5 | |
| High | CVE-2026-22775 | devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse | 7.5 | |
| High | CVE-2026-22774 | devalue vulnerable to denial of service due to memory exhaustion in devalue.parse | 7.5 | |
| Medium | CVE-2026-81176 | Svelte devalue: DoS via malformed input | 5.3 | |
| High | CVE-2026-30226 | devalue has prototype pollution in devalue.parse and devalue.unflatten | 7.5 | |
| High | CVE-2026-42570 | Svelte devalue: DoS via sparse array deserialization | 7.5 | |
| Medium | CVE-2026-123561 | Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion | 3.7 | |
| Medium | CVE-2026-123567 | Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten | 3.7 | |
| High | CVE-2025-57820 | Svelte devalue vulnerable to prototype pollution | — | |
| Medium | CVE-2026-123568 | Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output | 4.4 |