CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization
Attackers can cause excessive memory consumption and denial of service by sending crafted sparse arrays to the devalue library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-42570?
CVE-2026-42570 is a high-severity denial of service vulnerability in sveltejs devalue, published on 9 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.
Weakness: CWE-770
Which versions are affected by CVE-2026-42570?
2 open source packages ship an affected version, including devalue. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
devalue npm | From 5.6.3 | 5.8.1 |
devalue npm | From 5.6.3 | 5.8.1 |
Products include Svelte Devalue.
How do I fix CVE-2026-42570?
Upgrade devalue to 5.8.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-42570 being exploited?
There is no known exploitation of CVE-2026-42570 in the wild and no public exploit code.
Other vulnerabilities in sveltejs devalue
Sources
Also known as CLSA-2026-1778805970, GHSA-77vg-94rm-hx3p.