Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-123563 · CVE overview and exploitation status

EUVD-2026-119448

GHSA-6cvq-7mp2-2cxc

GHSA-r9w8-h9r3-54w4

cve-program · CVE-2026-123563

• https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
• https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse

euvd · EUVD-2026-119448

• https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
• https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse

nvd · CVE-2026-123563

• https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
• https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse

osv · GHSA-r9w8-h9r3-54w4

• https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
• https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99
• https://github.com/sveltejs/devalue
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

• Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed Arra… · Advisory content revised · 14 Nov 2026
• Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse · Newly collected advisory · 8 Nov 2026
• devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation · Advisory content revised · 8 Nov 2026