CVE-2026-22775: 
JavaScript vulnerability analysis and mitigation

CVE-2026-22775 is a denial-of-service vulnerability in the Svelte devalue npm package, a JavaScript library used to serialize values into strings when JSON.stringify is insufficient. Affecting versions 5.1.0 through 5.6.1, the flaw allows unauthenticated remote attackers to cause excessive CPU and/or memory consumption by supplying crafted input to devalue.parse. It was disclosed on January 15, 2026, and fixed in version 5.6.2. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Feedly).

The root cause is improper input validation (CWE-20) in the ArrayBuffer hydration logic within devalue.parse, which assumes input is a base64-encoded string but does not verify this assumption before attempting to decode it (CWE-405: Asymmetric Resource Consumption). An attacker can supply a non-string value (e.g., an object with a large length property) as the ArrayBuffer payload, causing the parser to attempt disproportionate memory allocation or CPU-intensive operations. The fix in commit 11755849 adds an explicit type check (if (typeof base64 !== 'string') throw new Error('Invalid ArrayBuffer encoding')) before decoding, and also addresses related self-referential and circular reference issues in TypedArray and custom reviver hydration paths (GitHub Advisory, Patch Commit).

Successful exploitation causes the affected Node.js application to consume excessive CPU time and/or memory, resulting in denial of service. Only the availability of the affected system is impacted — there is no confidentiality or integrity risk. Applications that expose devalue.parse to externally-supplied or user-controlled data are at risk, including SvelteKit-based web applications that use server-side data hydration (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (Feedly). The vulnerability requires no authentication and no user interaction, making it trivially exploitable against any exposed endpoint that calls devalue.parse on untrusted input. The EPSS score is approximately 0.038% (0.000380), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Identify target: Locate a web application using the devalue npm package (versions 5.1.0–5.6.1) that passes externally-supplied data to devalue.parse — common in SvelteKit server-side rendering or API endpoints.
2. Craft malicious payload: Construct a devalue-serialized string containing an ArrayBuffer entry with a non-string value, such as an object with a large length property: [["ArrayBuffer", {"length": 1000000000}]].
3. Send the payload: Submit the crafted input to the target endpoint via an HTTP request (e.g., POST body or query parameter) that feeds into devalue.parse.
4. Trigger resource exhaustion: The parser attempts to process the malformed ArrayBuffer entry without validating the type, causing excessive memory allocation or CPU consumption and degrading or crashing the service (GitHub Advisory, Patch Commit).

• Network: Repeated HTTP requests to endpoints that accept serialized devalue data, particularly with unusually large or malformed payloads in the request body.
• Logs: Node.js process logs showing out-of-memory errors or unhandled exceptions referencing devalue, parse.js, or ArrayBuffer hydration; application logs showing sudden spikes in request processing time.
• Process: Node.js process exhibiting abnormally high CPU or memory usage without a corresponding increase in legitimate traffic; process crashes or restarts triggered by memory exhaustion (OOM killer events on Linux).

The primary remediation is to upgrade the devalue npm package to version 5.6.2 or later, which validates that ArrayBuffer input is a string before decoding and adds circular reference detection (GitHub Release). For applications unable to upgrade immediately, implement input validation and resource limits before passing data to devalue.parse, restrict parsing of untrusted input at the application layer, and apply rate limiting on endpoints that process externally-supplied serialized data (Feedly). Red Hat has also issued advisories (RHSA-2026:2144, RHSA-2026:2926) for downstream packages affected by this vulnerability.

The Svelte team published an official blog post covering CVEs affecting the Svelte ecosystem, including this vulnerability (Svelte Blog). The vulnerability was noted on Hacker News and social media platforms including Mastodon and Bluesky, with coverage from TheHackerWire. Community reaction was generally low-key given the limited scope and absence of active exploitation.