devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92708 · CVE overview and exploitation status

EUVD-2026-83362

GHSA-j22f-vq7h-c4qm

cve-program · CVE-2026-92708

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

euvd · EUVD-2026-83362

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

nvd · CVE-2026-92708

• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3
• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm

osv · GHSA-j22f-vq7h-c4qm

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://nvd.nist.gov/vuln/detail/CVE-2026-92708
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

No related changes are available here.