Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse
cve-program · CVE-2026-123563
PublishedDevalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.
Read the publisher's advisoryeuvd · EUVD-2026-119448
PublishedDevalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.
Read the publisher's advisorynvd · CVE-2026-123563
PublishedDevalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.
Read the publisher's advisoryosv · GHSA-r9w8-h9r3-54w4
PublishedUnder very specific circumstances, `parse` could create massive ArrayBuffers with very small input. This required a malformed `ArrayBuffer` custom reviver.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-123563 · CVE overview and exploitation status
cve-program · CVE-2026-123563
- https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
- https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse
euvd · EUVD-2026-119448
- https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
- https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse
nvd · CVE-2026-123563
- https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4
- https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse
osv · GHSA-r9w8-h9r3-54w4
Related changes
Linked by CVE identifier- Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed Arra… · Advisory content revised · 14 Nov 2026
- Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse · Newly collected advisory · 8 Nov 2026
- devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation · Advisory content revised · 8 Nov 2026