Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-42570: Svelte Excessive Memory Consumption via Sparse Array Deserialization

CVE-2026-42570 · published 4 months ago

Summary

A bug in Svelte's `devalue.parse` function can cause it to use too much memory when handling certain types of data. This can lead to performance issues or even crashes. To fix this, update to the latest version of Svelte.

What to do

Update GitHub Actions devalue to version 5.8.1.
Update svelte devalue to version 5.8.1 or later.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	devalue	>= 5.6.3, <= 5.8.0 Fix: upgrade to 5.8.1
–	svelte	devalue	>= 5.6.3, < 5.8.1 `cpe:2.3:a:svelte:devalue::::::node.js::*`

Original advisory text

Svelte devalue: DoS via sparse array deserialization

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

References

https://github.com/sveltejs/devalue/releases/tag/v5.8.1 URL
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42570.json URL
https://access.redhat.com/errata/RHSA-2026:37272 Vendor Advisory
https://github.com/advisories/GHSA-77vg-94rm-hx3p
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42570... Vendor Advisory
https://access.redhat.com/errata/RHSA-2026:57590 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-42570 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-42570 Vendor Advisory
https://github.com/sveltejs/devalue/security/advisories/GHSA-77vg-94rm-hx3p Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2487050 Third Party Advisory
https://github.com/sveltejs/devalue/commit/206ca6712fbc380a4571c59de9ab04b911107... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-770Allocation of Resources Without Limits

Timeline

Published9 Jun 2026

Updated4 Nov 2026

First seen14 May 2026

Sources

GHSA-77vg-94rm-hx3p · GHSA

CVE-2026-42570 · NVD

CVE-2026-42570 · OSV

Track software like this

Free during beta