# CVE-2026-123564

Memory exhaustion via uneval of large sparse arrays in sveltejs devalue (<5.9.3)

- Page: https://www.vulneraibility.com/cve/CVE-2026-123564
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 0.34% (percentile 28.1)
- Weakness: CWE-770
- Also known as: GHSA-wf3x-273g-mvxv
- Published: 2026-11-08

## Affected versions

- sveltejs devalue: affected >= 1.0.0 and < 5.9.3; fixed in 5.9.3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Remote memory exhaustion (DoS) by attacker-influenced sparse arrays in uneval-generated code, crashing browsers or Node.js runtimes.

## Action

Patch when possible

## Recommendation

Upgrade devalue to >=5.9.3 and sanitize/limit serialized array sizes.

## References

- [advisory] https://github.com/sveltejs/devalue/security/advisories/GHSA-wf3x-273g-mvxv
- [advisory] https://www.vulncheck.com/advisories/sveltejs-devalue-before-5.9.3-memory-exhaustion-via-uneval-sparse-arrays

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.