Sveltejs / Devalue
7 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-92708 | devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers | HIGH | 7.5 | Sep 18, 2026 |
| CVE-2026-81176 | Svelte devalue: DoS via malformed input | MEDIUM | 5.3 | Sep 16, 2026 |
| CVE-2026-42570 | Svelte devalue: DoS via sparse array deserialization | HIGH | 7.5 | Jun 9, 2026 |
| CVE-2026-30226 | devalue has prototype pollution in devalue.parse and devalue.unflatten | MEDIUM | 6.3 | Mar 11, 2026 |
| CVE-2026-22775 | devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse | HIGH | 7.5 | Jan 15, 2026 |
| CVE-2026-22774 | devalue vulnerable to denial of service due to memory exhaustion in devalue.parse | HIGH | 7.5 | Jan 15, 2026 |
| CVE-2025-57820 | Svelte devalue vulnerable to prototype pollution | HIGH | 7.9 | Aug 26, 2025 |
Showing 1 to 7 of 7 CVEs