GHSA-9rgm-9g3h-6x36

Source

https://github.com/advisories/GHSA-9rgm-9g3h-6x36

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9rgm-9g3h-6x36/GHSA-9rgm-9g3h-6x36.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-9rgm-9g3h-6x36

Aliases

CVE-2026-81176

Published

2026-09-17T20:28:21Z

Modified

2026-09-17T20:45:04Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

Svelte devalue: DoS via malformed input

Details

Impact

devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.

Applications are potentially affected if they call devalue.parse with untrusted data.

Patches

The bug is fixed in devalue@5.9.2.

Database specific

{
    "cwe_ids": [
        "CWE-770"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-17T20:28:21Z",
    "nvd_published_at": "2026-09-16T19:17:43Z",
    "severity": "MODERATE"
}

References

Affected packages

npm / devalue

Package

Name: devalue; View open source insights on deps.dev
Purl: pkg:npm/devalue

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

5.9.2

Database specific

last_known_affected_version_range

"< 5.9.1"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9rgm-9g3h-6x36/GHSA-9rgm-9g3h-6x36.json"