| GHSA-hx4r-w6wj-j8fg | 보통 | devalue: Residual sparse-array CPU amplification in uneval | 01/10/2026 |
| GHSA-mcm9-63f2-9j32 | 높음 | devalue: Repeated primitive strings cause quadratic expansion in uneval | 01/10/2026 |
| GHSA-wf3x-273g-mvxv | 낮음 | devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated | 01/10/2026 |
| GHSA-r9w8-h9r3-54w4 | 높음 | devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation | 01/10/2026 |
| GHSA-x5rw-q4pp-hg5g | 높음 | devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise | 01/10/2026 |
| GHSA-4q55-j62x-fr9h | 보통 | devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion | 01/10/2026 |
| CVE-2026-92708 | 높음7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose b | 18/09/2026 |
| CVE-2026-81176 | 보통5.3 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alte | 16/09/2026 |
| CVE-2026-42570 | 높음7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arra | 09/06/2026 |
| GHSA-mwv9-gp5h-frr4 | 낮음 | Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties | 12/03/2026 |
| CVE-2026-30226 | 높음7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Servic | 11/03/2026 |
| GHSA-33hq-fvwr-56pm | 낮음 | devalue affected by CPU and memory amplification from sparse arrays | 19/02/2026 |
| GHSA-8qm3-746x-r74r | 낮음 | devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed | 19/02/2026 |
| CVE-2026-22775 | 높음7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted source | 15/01/2026 |
| CVE-2026-22774 | 높음7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted source | 15/01/2026 |
| CVE-2025-57820 | 높음7.9 | Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has | 26/08/2025 |