CVE-2026-22775-nvd.nist.gov-Received

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs…

Published:

14 January 2026 at 23:00:00

Alert date:

15 January 2026 at 20:02:18

Source:

nvd.nist.gov

Web Technologies, Supply Chain & Dependencies

CVE-2026-22775 affects Svelte devalue JavaScript library versions 5.1.0 to 5.6.1. The vulnerability allows certain inputs to cause devalue.parse to consume excessive CPU time and/or memory, leading to denial of service attacks. The issue occurs in ArrayBuffer hydration which expects base64 encoded strings but doesn't validate input before decoding. Applications using devalue.parse on externally-supplied data are at risk. The vulnerability has been fixed in version 5.6.2.

Technical details

Mitigation steps:

Affected products:

Svelte devalue