CVE-2026-22775: Svelte Devalue DOS Vulnerability

CVE-2026-22775 Overview

CVE-2026-22775 is a Denial of Service vulnerability in Svelte devalue, a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From versions 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources.

Critical Impact
Applications using devalue.parse on externally-supplied data are vulnerable to resource exhaustion attacks that can render services unavailable.

Affected Products

Svelte devalue versions 5.1.0 through 5.6.1
Node.js applications using the vulnerable devalue package
SvelteKit applications that process untrusted serialized data

Discovery Timeline

January 15, 2026 - CVE-2026-22775 published to NVD
January 20, 2026 - Last updated in NVD database

Technical Details for CVE-2026-22775

Vulnerability Analysis

This vulnerability affects applications that use the devalue.parse function to deserialize data from untrusted sources. The flaw resides in the ArrayBuffer hydration mechanism, which expects base64 encoded strings as input but fails to validate this assumption before attempting to decode the input.

When malicious or malformed input is provided to devalue.parse, the library may enter a state where it consumes excessive computational resources. This resource exhaustion can manifest as high CPU utilization, memory exhaustion, or both, depending on the nature of the crafted input.

The vulnerability is classified under CWE-405 (Asymmetric Resource Consumption), which describes scenarios where an attacker can cause disproportionate resource consumption relative to the effort required to trigger it. In this case, a relatively small malicious payload could potentially cause significant resource exhaustion on the server.

Root Cause

The root cause is insufficient input validation in the ArrayBuffer hydration code path. The devalue.parse function assumes that input intended for ArrayBuffer hydration will be properly base64 encoded, but this assumption is never verified before processing begins. When non-base64 or specially crafted input is provided, the parsing logic may behave unexpectedly, leading to excessive resource consumption.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted serialized data to any endpoint that uses devalue.parse to process user-supplied input.

Common attack scenarios include:

Targeting API endpoints that accept serialized data from clients
Exploiting SvelteKit server-side rendering paths that deserialize client state
Attacking any web service that uses devalue for data transfer between client and server

The vulnerability does not compromise confidentiality or integrity, but can severely impact service availability by exhausting server resources.

Detection Methods for CVE-2026-22775

Indicators of Compromise

Abnormal CPU spikes correlated with incoming requests to endpoints using devalue.parse
Memory consumption anomalies in Node.js processes handling serialization
Increased response latency or timeouts on affected application routes
Application crashes or out-of-memory errors in server logs

Detection Strategies

Monitor Node.js process resource consumption for unusual patterns during request processing
Implement request payload size limits on endpoints that process serialized data
Set up alerting for CPU and memory threshold breaches on application servers
Review application dependencies for vulnerable devalue versions using npm audit or similar tools

Monitoring Recommendations

Enable application performance monitoring (APM) to track resource usage per request
Configure log aggregation to identify patterns of failed or slow serialization operations
Implement rate limiting on endpoints that accept untrusted serialized data
Set up dependency scanning in CI/CD pipelines to detect vulnerable package versions

How to Mitigate CVE-2026-22775

Immediate Actions Required

Upgrade Svelte devalue to version 5.6.2 or later immediately
Audit all application code for usage of devalue.parse with untrusted input
Implement input validation and size limits on affected endpoints as a defense-in-depth measure
Consider temporarily disabling endpoints that accept untrusted serialized data until patching is complete

Patch Information

The vulnerability has been fixed in devalue version 5.6.2. The fix was implemented in commit 11755849fa0634ae294a15ec0aef2f43efcad7c4, which adds proper validation of base64 input before ArrayBuffer hydration processing.

For detailed information about the vulnerability and fix, refer to the GitHub Security Advisory GHSA-g2pg-6438-jwpf. The patched version is available on the GitHub Releases page.

Workarounds

Validate and sanitize all input before passing to devalue.parse
Implement request timeouts and resource limits at the application or infrastructure level
Use a Web Application Firewall (WAF) to filter potentially malicious payloads
Restrict endpoints using devalue.parse to authenticated users where possible

bash

# Update devalue to the patched version
npm update devalue@5.6.2

# Verify the installed version
npm list devalue

# Run security audit to check for other vulnerabilities
npm audit