PT-2026-3093 · Devalue+1 · Devalue+1

Jviide · Published 2026-01-15 · Updated 2026-01-16 · CVE-2026-22775

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Svelte devalue versions 5.1.0 through 5.6.1

Description Certain inputs can cause the devalue.parse function to consume excessive CPU time and/or memory, potentially leading to a denial of service. This affects applications using devalue.parse on externally-supplied data. The issue stems from the ArrayBuffer hydration logic not validating input before processing, specifically expecting base64 encoded strings without verification.

Recommendations Upgrade to version 5.6.2 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-405

Related Identifiers

BDU:2026-02097

CVE-2026-22775

GHSA-G2PG-6438-JWPF

Affected Products

Svelte

Devalue

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22775.json · Exploit
• https://github.com/sveltejs/devalue/security/advisories/GHSA-g2pg-6438-jwpf · Vendor Advisory
• https://github.com/sveltejs/devalue/commit/11755849fa0634ae294a15ec0aef2f43efcad7c4 · Patch
• https://osv.dev/vulnerability/CVE-2026-22775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22775 · Security Note
• https://osv.dev/vulnerability/GHSA-g2pg-6438-jwpf · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-02097 · Security Note
• https://github.com/sveltejs/devalue · Note
• https://github.com/sveltejs/devalue/releases/tag/v5.6.2 · Note
• https://twitter.com/_cvereports/status/2012012802173530229 · Twitter Post
• https://twitter.com/CVEnew/status/2011926065829331236 · Twitter Post