CVE-2026-123565 json
Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval
published last mo. modified yesterday also EUVD-2026-119450 , GHSA-mcm9-63f2-9j32
- cvss
- 7.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.
Patch / fix
- npm devalue 5.9.3
- sveltejs devalue 5.9.3
Is CVE-2026-123565 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- yesterday
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| CNA | 4.0 | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| npm | devalue | <5.9.3 |
5.9.3 |
Affected products
- sveltejs devalue
Classification
References
-
github.com
/sveltejs/devalue/commit/84f6f67999104e36940f744bec0443536de1b463
web
-
github.com
/sveltejs/devalue/security/advisories/GHSA-mcm9-63f2-9j32
vendor-advisory, web, advisory
-
vulncheck.com
/advisories/devalue-before-5.9.3-quadratic-expansion-denial-of-service-via-uneval
third-party-advisory
-
github.com
/sveltejs/devalue
package
-
github.com
/sveltejs/devalue/releases/tag/v5.9.3
web
Sources
- CVE List CVE-2026-123565
- GitHub Advisory GHSA-mcm9-63f2-9j32
- NVD CVE-2026-123565
- Maintainer advisory GHSA-mcm9-63f2-9j32
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
The maintainers of sveltejs/devalue published their own advisory on GitHub. Reviewed sources take precedence over it.