7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-22775

CVE-2026-22775: devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-22775

CVE-2026-22775:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devalue	npm	>= 5.1.0, < 5.6.2	5.6.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the devalue library's parsing mechanism, specifically within the unflatten function, which is invoked by the exported parse function. The security flaw allows for a denial-of-service attack when devalue.parse is used on untrusted data. The patch is applied to the unflatten function in src/parse.js.

The vulnerability stems from two primary issues related to resource exhaustion from specially crafted inputs:

Invalid ArrayBuffer Value: The logic for deserializing an ArrayBuffer presumed its value would be a base64-encoded string but failed to validate this. An attacker could supply a non-string value (such as a large object), causing the decode64 function to consume excessive CPU and memory, resulting in a denial of service. The fix introduces a typeof base64 !== 'string' check to mitigate this.
Circular References: The patch also adds checks to prevent infinite recursion caused by circular references in the input data. This affects both TypedArrays and objects with custom revivers. For instance, a TypedArray could be crafted to reference itself as its own underlying buffer, leading to an infinite loop during the hydration process.

The main vulnerable function is unflatten, as it contains the flawed logic. The hydrate function, where the changes are implemented, is an inner function of unflatten, making unflatten the correct scope for identification. The parse function serves as the user-facing API and the entry point for the vulnerability, so it would also be present in any runtime profile of an exploit. Consequently, both parse and unflatten are the critical functions to monitor.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.