Skip to content
fr Sign in
7.5 High

CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for…

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

Affected products and versions

Product Affected versions Fixed in
devalue 5.6 5.6.3 → < 5.8.1 5.8.1
Red Hat Build of Podman Desktop Versions not published
Red Hat Trusted Artifact Signer Versions not published
Red Hat Trusted Artifact Signer 1.4 1783327185 earliest → < 1783327185 1783327185
Red Hat Enterprise Linux 10 Versions not published

References

Timeline

  1. Published
  2. Last modified

Other CVEs of devalue

The 7 CVEs of devalue →
CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 5.3 Medium CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 6.3 Medium CVE-2026-22775 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High
Track this CVE