# CVE-2026-123569

devalue (<5.6.3) npm package allows CPU/memory DoS via sparse-array serialization

- Page: https://www.vulneraibility.com/cve/CVE-2026-123569
- CVSS: 8.7
- Known exploited: not in CISA KEV as of our last sync
- Weakness: CWE-770
- Published: 2026-11-08

## Affected versions

- sveltejs devalue: affected < 5.6.3; fixed in 5.6.3

A version outside these ranges is not a statement that it is unaffected.

## Impact

Denial of Service: attacker-controlled sparse arrays cause excessive CPU/memory during devalue stringify/uneval, crashing or exhausting Node.js servers.

## Action

Patch when possible

## Recommendation

Upgrade devalue to >=5.6.3; avoid/validate serializing untrusted sparse arrays; monitor resource usage.

## References

- [advisory] https://github.com/sveltejs/devalue/security/advisories/GHSA-33hq-fvwr-56pm
- [advisory] https://www.vulncheck.com/advisories/devalue-before-5.6.3-denial-of-service-via-sparse-array-serialization

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.