7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42570

CVE-2026-42570: Svelte devalue: DoS via sparse array deserialization

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42570

CVE-2026-42570:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
devalue	npm	>= 5.6.3, <= 5.8.0	5.8.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the devalue library's deserialization logic, specifically in how it handles sparse arrays. The entry point for an attack is the exported parse function. This function calls an internal function named unflatten to reconstruct the JavaScript object from a parsed JSON structure.

The root cause of the vulnerability lies within the unflatten function. When it encountered a sparse array representation, the vulnerable code would instantiate an array with new Array(len), where len was a number read directly from the serialized input. Some JavaScript engines, like V8, will pre-allocate memory for the array up to a certain size. By providing a large value for len in a malicious payload, an attacker could force the server to allocate an extremely large amount of memory, causing the process to crash, resulting in a Denial of Service. The patch fixes this by avoiding new Array(len) and instead creating an empty array, manipulating it to force the engine to use a memory-efficient sparse representation, and only setting the length property at the end.

Vulnerable functions

parse

src/parse.js

The `parse` function is the main entry point for the deserialization process. It takes a serialized string as input and passes the parsed object to the `unflatten` function. A malicious string can be passed to `parse` to trigger the Denial of Service vulnerability within the `unflatten` function.

unflatten

src/parse.js

The `unflatten` function contained the core vulnerability. When deserializing a sparse array, it used `new Array(len)` where `len` was a value from the untrusted input. Certain JavaScript engines would eagerly allocate memory for this array. An attacker could provide a very large `len` value, causing the application to allocate a huge amount of memory, leading to a Denial of Service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.