# CVE-2026-123562

Devalue bug allows attacker-controlled async values to crash Node.js via unhandled rejection.

- Page: https://www.vulneraibility.com/cve/CVE-2026-123562
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-248
- Published: 2026-11-08

## Affected versions

- sveltejs devalue: affected >= 5.8.0 and < 5.9.3; fixed in 5.9.3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote/attacker-influenced denial-of-service: crafted async values can cause unhandled promise rejection that terminates Node.js processes.

## Action

Patch when possible

## Recommendation

Upgrade devalue to >=5.9.3 and restart affected Node.js services.

## References

- [advisory] https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g
- [advisory] https://www.vulncheck.com/advisories/devalue-5.8.0-before-5.9.3-denial-of-service-via-stringifyasync-unhandled-rejection

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.