Two devalue Vulnerabilities Patched: Memory Disclosure and DoS Risk in Svelte's Serialization Library

What happened

Two vulnerabilities were identified in devalue, a JavaScript library that serializes values into strings when JSON.stringify is insufficient. CVE-2026-92708 affects the stringify and uneval functions: when serializing a typed array, devalue emitted the entire backing ArrayBuffer rather than just the relevant view. Because Node's Buffer objects are backed by a process-wide shared memory pool, serializing even a small Buffer could expose up to 64 KB of unrelated process memory, including data from other in-flight requests. Separately, CVE-2026-81176 affects devalue.parse, which failed to reject out-of-bounds indices greater than or equal to values.length. A crafted payload could exploit this to force quadratic processing cost as payload size grows, leading to denial of service when parsing untrusted devalue data.

Technical cause

For CVE-2026-92708, the root cause is that devalue's serialization logic for typed arrays captured the full underlying ArrayBuffer instead of the view's own bounds. Node Buffer objects frequently share a single larger backing pool for efficiency, so emitting the whole buffer leaks adjacent memory that was never intended to be part of the serialized value. This occurs purely during serialization and is not affected by existing prototype-pollution or DoS guards in the parser, since those only apply to parsing untrusted input, not to stringify/uneval output. For CVE-2026-81176, the parser in src/parse.js did not validate that array indices stayed within bounds (less than values.length). An attacker-controlled payload could exploit this to cause the parser to alternate between array representations, resulting in quadratic processing time relative to payload size.

Why it matters

In server-side-rendered applications built with frameworks like SvelteKit or Nuxt, a public page that returns a small Buffer from its load() function, or reads a small file, could unintentionally leak another user's request body or Authorization header directly in the page HTML, without any authentication required. This can happen on every render of the affected page, making it a persistent and silent information disclosure risk rather than a one-off occurrence. The DoS issue separately allows an attacker to degrade application availability by submitting crafted devalue payloads that are expensive to parse.

Who is affected

Any application or service using the devalue npm package is potentially affected, including those using it indirectly through frameworks such as SvelteKit or Nuxt for server-side rendering. For CVE-2026-92708, applications are at risk if they serialize Node Buffer objects (or other typed arrays backed by shared memory pools) via devalue's stringify or uneval functions. For CVE-2026-81176, applications that use devalue.parse to process untrusted or externally supplied serialized data are at risk.

Affected versions

CVE-2026-92708 affects devalue versions from 5.1.0 through 5.9.2 inclusive. CVE-2026-81176 affects devalue versions prior to 5.9.1 (i.e., all versions from 0 up to but not including 5.9.1).

Fixes and mitigation

CVE-2026-92708 is fixed in devalue version 5.9.3. As a workaround prior to upgrading, applications can convert Node Buffer objects to Uint8Array before serialization to avoid exposing the shared backing memory. CVE-2026-81176 is fixed in devalue version 5.9.2, which adds bounds checking to reject out-of-bounds indices during parsing.

Recommended action

Upgrade devalue to version 5.9.3 or later, which addresses both vulnerabilities. If an immediate upgrade is not possible, apply the documented workaround of converting Node Buffer objects to Uint8Array before serialization to mitigate CVE-2026-92708, and avoid parsing untrusted devalue data until patched to reduce exposure to CVE-2026-81176. Review server-side-rendered pages for any load() functions or file reads that return Buffer objects, as these may have been silently leaking data.