devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92708 · Microsoft / collected KEV context

EUVD-2026-83362

GHSA-j22f-vq7h-c4qm

cve-program · CVE-2026-92708

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

euvd · EUVD-2026-83362

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

nvd · CVE-2026-92708

• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3
• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm

osv · GHSA-j22f-vq7h-c4qm

• https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
• https://nvd.nist.gov/vuln/detail/CVE-2026-92708
• https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
• https://github.com/sveltejs/devalue
• https://github.com/sveltejs/devalue/releases/tag/v5.9.3

No related operational record is retained in the current change model.