CVE-2026-123562 Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-123562?
CVE-2026-123562 is a high-severity vulnerability in sveltejs devalue, published on 8 Nov 2026.
Official description
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.
Weakness: CWE-248
Which versions are affected by CVE-2026-123562?
1 open source package ship an affected version, including devalue.
| Package | Affected | Fixed in |
|---|---|---|
devalue npm | From 5.8.0 | 5.9.3 |
How do I fix CVE-2026-123562?
Upgrade devalue to 5.9.3 or later.
Is CVE-2026-123562 being exploited?
There is no known exploitation of CVE-2026-123562 in the wild and no public exploit code.
Sources
Also known as GHSA-6jpw-759r-8m52, GHSA-x5rw-q4pp-hg5g.