CVE-2026-92708

Name of the Vulnerable Software and Affected Versions Svelte devalue versions 5.1.0 through 5.9.2

Description The stringify() and uneval() functions serialize typed arrays by emitting the entire backing ArrayBuffer instead of only the view. When serializing a Node Buffer, which uses a process-wide shared pool, this can disclose up to 64 KB of unrelated process memory, potentially including data from other concurrent requests such as request bodies or Authorization headers. In server-side-rendered frameworks like SvelteKit or Nuxt, this may result in sensitive information being included in the HTML of a public page without authentication. This issue occurs during serialization and is not prevented by existing prototype-pollution or denial-of-service guards.

Recommendations Update to version 5.9.3. As a temporary workaround, convert Node Buffer objects to Uint8Array before serialization.