CVE-2026-81176

Name of the Vulnerable Software and Affected Versions Svelte devalue versions prior to 5.9.2

Description Svelte devalue is a JavaScript library used to serialize values into strings. The devalue.parse() function in src/parse.js fails to reject out-of-bounds indices that are greater than or equal to values.length. An attacker can provide a specially crafted untrusted payload that forces the parser to alternate between array representations. This results in quadratic work as the payload size increases, leading to a denial of service in applications that parse untrusted data.

Recommendations Update Svelte devalue to version 5.9.2.