PT-2026-3092 · Devalue+1 · Devalue+1

Jviide · Published 2026-01-15 · Updated 2026-01-15 · CVE-2026-22774

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Svelte devalue versions 5.3.0 through 5.6.1

Description Certain inputs can cause the devalue.parse function to consume excessive CPU time and/or memory, potentially leading to a denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking this assumption before creating the typed array.

Recommendations Upgrade to version 5.6.2 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-405

CWE-20

Related Identifiers

CVE-2026-22774

GHSA-VW5P-8CQ8-M7MV

Affected Products

Svelte

Devalue

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22774.json · Exploit
• https://github.com/sveltejs/devalue/commit/e46afa64dd2b25aa35fb905ba5d20cea63aabbf7 · Patch
• https://github.com/sveltejs/devalue/security/advisories/GHSA-vw5p-8cq8-m7mv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-22774 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22774 · Security Note
• https://osv.dev/vulnerability/GHSA-vw5p-8cq8-m7mv · Vendor Advisory
• https://github.com/sveltejs/devalue · Note
• https://github.com/sveltejs/devalue/releases/tag/v5.6.2 · Note
• https://github.com/sveltejs/devalue/commit/11755849fa0634ae294a15ec0aef2f43efcad7c4 · Note
• https://twitter.com/CVEnew/status/2011926066802327900 · Twitter Post