CVE-2026-123569
devalue (<5.6.3) npm package allows CPU/memory DoS via sparse-array serialization
do firstUpgrade to a fixed release: 5.6.3.
Can a WAF block it? No. The vulnerability involves CPU/memory denial of service through sparse-array serialization in a Node.js package, which requires local code execution or input processing within the application, not directly from HTTP requests. A web application firewall only sees HTTP traffic, so it is not on this attack's path.
Also consider: rate limit · patch
Based on an AI reading of the CVE description, and no vendor rule found yet. We check Cloudflare, AWS, Google Cloud Armor and Azure; for Akamai, Imperva, Fastly, F5, ask your vendor.
Is CVE-2026-123569 being exploited?
Not confirmed. CVE-2026-123569 does not appear in CISA's Known Exploited Vulnerabilities catalog, which records only exploitation that has been observed and reported publicly. That is evidence of absence of a report, not evidence the flaw is unattacked.
How severe is CVE-2026-123569?
CVE-2026-123569 is rated High with a CVSS score of 8.7. Severity describes how bad exploitation would be, not how likely it is: pair it with exploitation evidence before deciding what to patch first.
Is there a patch for CVE-2026-123569?
Yes. A fix has been recorded for CVE-2026-123569. The vendor advisory is the authority on the exact fixed version — apply it from there rather than from a summary.
What does CVE-2026-123569 affect?
CVE-2026-123569 affects devalue npm package <5.6.3, Node.js applications/servers using devalue, Projects bundling devalue (e.g., some Svelte builds). Confirm the exact affected versions against the vendor advisory before deciding you are exposed.
What should I do about CVE-2026-123569?
Upgrade devalue to >=5.6.3; avoid/validate serializing untrusted sparse arrays; monitor resource usage.
Exploitation status reflects CISA's KEV catalog as we last synced it. Check the catalog directly.
Denial of Service: attacker-controlled sparse arrays cause excessive CPU/memory during devalue stringify/uneval, crashing or exhausting Node.js servers.
Patch when possible
- affected< 5.6.3
As published in the CVE Program record. A version outside these ranges is not a statement that it is unaffected — vendors sometimes understate a range, and distribution-backported builds carry upstream numbers that do not reflect what was patched into them.
timeline
- 8 Nov 2026Published
- 8 Nov 2026CVE record last updated · same day later
- 8 Nov 2026Analysed by vulneraibility.com · same day later
- Advisorygithub.com /sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm
- Advisoryvulncheck.com /advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serializatio
sources
- CVE List (CVE.org): description, affected versions, references; CVE Terms of Use
- NVD: CVSS and CPE data
- FIRST EPSS: exploit probability and percentile
- Summary, impact and triage tags: written by our AI analysis pipeline from the sources above. Check them against the sources.