CVE-2026-22775

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-22775
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22775.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-22775
Aliases
Published
2026-01-15T18:59:37.499Z
Modified
2026-01-18T03:43:25.406065Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
Details

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22775.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-405"
    ]
}
References

Affected packages

Git / github.com/sveltejs/devalue

Affected ranges

Type
GIT
Repo
https://github.com/sveltejs/devalue
Events
Introduced
293d70bb7a3312741c370c8989fff0b5525647de
Fixed
fcf4e88275f2e2e45b9ea70ffaa5247c8f55f057

Affected versions

v5.*

v5.1.0
v5.1.1
v5.3.0
v5.3.1
v5.3.2
v5.4.0
v5.4.1
v5.4.2
v5.5.0
v5.6.0
v5.6.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-22775.json"