CVE-2026-42570EPSS p32.0%

CVE-2026-42570CVE-2026-42570

svelte / devalue

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

Scoring

CVSS 7.5 ()
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS0.39% probability of exploitation · percentile 32.0% · 2026-08-03T12:00:16Z
Last modified2026-07-23

Related by meaning· 6

Nearest entities by semantic similarity across the cs-graph corpus.

CVE
CVE-2026-42567
CVE
CVE-2026-42573
CVE
CVE-2026-42599
CVE
CVE-2025-67647
CVE
CVE-2026-23736
CVE
CVE-2025-12727
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.