CVE-2026-42570: Svelte devalue DoS Vulnerability

CVE-2026-42570 Overview

CVE-2026-42570 affects Svelte devalue, a JavaScript library that serializes values into strings when JSON.stringify is insufficient. The flaw exists in devalue.parse from version 5.6.3 to before version 5.8.1. Attackers can submit specially crafted serialized payloads that exploit JavaScript engine quirks during sparse array deserialization. The runtime allocates substantially more memory than required, leading to resource exhaustion. The maintainers patched the issue in version 5.8.1 by validating array index and length bounds. The vulnerability is classified as Allocation of Resources Without Limits or Throttling [CWE-770].

Critical Impact
Remote, unauthenticated attackers can trigger excessive memory consumption against any service calling devalue.parse on untrusted input, resulting in denial of service.

Affected Products

Svelte devalue versions 5.6.3 through 5.8.0
Applications and SvelteKit deployments using devalue.parse on untrusted input
Server-side Node.js services that deserialize client-supplied devalue payloads

Discovery Timeline

2026-06-09 - CVE-2026-42570 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-42570

Vulnerability Analysis

The devalue library encodes sparse arrays using a sentinel marker (SPARSE = -7) followed by index-value pairs. When devalue.parse reconstructs the array, it honors the index values provided in the serialized payload. A malicious payload can specify extremely large indices that fall within the syntactic limits of a JavaScript array but cause the engine to pre-allocate or grow backing storage aggressively.

The impact is limited to availability. The vulnerability does not permit code execution, data tampering, or information disclosure. However, a single small request can consume gigabytes of heap memory, crashing the Node.js process or starving co-tenant workloads.

Root Cause

The root cause is missing validation of array index and length values during sparse array reconstruction [CWE-770]. Before the patch, parse.js accepted any numeric index from the serialized stream without comparing it against the maximum valid JavaScript array index. The fix introduces MAX_ARRAY_LEN = 2 ** 32 - 1 and MAX_ARRAY_INDEX constants, then enforces them via is_valid_array_index and is_valid_array_len helpers.

Attack Vector

An attacker submits a crafted devalue-encoded string to any endpoint that calls devalue.parse. The payload declares a sparse array with an index near 2^32. When the parser instantiates the array and assigns to that index, the underlying engine allocates memory proportional to the index. No authentication or user interaction is required.

javascript

// Patch: src/constants.js - new bounds constants
export const NEGATIVE_INFINITY = -5;
export const NEGATIVE_ZERO = -6;
export const SPARSE = -7;

// The largest valid value for a JavaScript array's `length` property,
// and the largest valid array index (one less than the max length).
export const MAX_ARRAY_LEN = 2 ** 32 - 1;
export const MAX_ARRAY_INDEX = MAX_ARRAY_LEN - 1;

// Patch: src/parse.js - import validation helpers
import { decode64 } from './base64.js';
import {
    HOLE,
    MAX_ARRAY_INDEX,
    NAN,
    NEGATIVE_INFINITY,
    NEGATIVE_ZERO,
    POSITIVE_INFINITY,
    SPARSE,
    UNDEFINED
} from './constants.js';
import { is_valid_array_index, is_valid_array_len } from './utils.js';

Source: sveltejs/devalue commit 206ca67

Detection Methods for CVE-2026-42570

Indicators of Compromise

Node.js processes terminating with JavaScript heap out of memory or FATAL ERROR: Reached heap limit messages shortly after receiving HTTP requests
Sudden resident set size (RSS) spikes correlated with calls into devalue.parse
Inbound request bodies containing the SPARSE sentinel (-7) followed by large integer indices
Repeated process restarts on SvelteKit form actions or API routes handling serialized state

Detection Strategies

Inventory package-lock.json and yarn.lock files for devalue versions between 5.6.3 and 5.8.0 across all Node.js services
Deploy software composition analysis (SCA) tooling to flag vulnerable devalue versions in build pipelines
Add application-level logging around devalue.parse invocations to capture payload size and parse duration
Configure web application firewall (WAF) rules to alert on requests containing the SPARSE marker paired with indices above a safe threshold

Monitoring Recommendations

Track Node.js heap usage, garbage collection pauses, and process exit codes per service
Correlate request-rate anomalies with memory allocation spikes to surface attempted exploitation
Alert on out-of-memory restarts in container orchestrators such as Kubernetes via OOMKilled events

How to Mitigate CVE-2026-42570

Immediate Actions Required

Upgrade devalue to version 5.8.1 or later in every project consuming the library
Rebuild and redeploy SvelteKit applications that bundle devalue as a transitive dependency
Audit all server endpoints that invoke devalue.parse on data sourced from clients, message queues, or third-party APIs
Enforce request body size limits at the reverse proxy or framework layer to reduce the blast radius of malformed payloads

Patch Information

The fix shipped in devalue v5.8.1. The patch adds MAX_ARRAY_LEN and MAX_ARRAY_INDEX constants in src/constants.js and introduces is_valid_array_index and is_valid_array_len validators applied during parsing in src/parse.js. Review the GitHub Security Advisory GHSA-77vg-94rm-hx3p and the v5.8.1 release notes for full details.

Workarounds

Reject requests whose serialized payloads exceed an application-specific byte limit before passing them to devalue.parse
Run devalue.parse inside a worker thread with a constrained --max-old-space-size so memory exhaustion does not terminate the main process
Pre-validate untrusted input and strip or reject payloads containing the SPARSE sentinel followed by indices above a known safe maximum

bash

# Upgrade devalue to the patched release
npm install devalue@^5.8.1

# Verify the resolved version across the dependency tree
npm ls devalue

# Run a worker with a constrained heap to bound memory exhaustion
node --max-old-space-size=512 worker.js