# CVE-2026-123566

devalue <5.9.3 CPU-amplification DoS via sparse arrays to uneval

- Page: https://www.vulneraibility.com/cve/CVE-2026-123566
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-400
- Published: 2026-11-08

## Affected versions

- sveltejs devalue: affected < 5.9.3; fixed in 5.9.3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Denial of Service: attacker-supplied sparse arrays to uneval cause CPU amplification and block the Node.js event loop, freezing affected apps.

## Action

Patch when possible

## Recommendation

Upgrade devalue to >=5.9.3; avoid uneval on untrusted data.

## References

- [advisory] https://github.com/sveltejs/devalue/security/advisories/GHSA-hx4r-w6wj-j8fg
- [advisory] https://www.vulncheck.com/advisories/devalue-before-5.9.3-cpu-amplification-denial-of-service-via-uneval

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.