Bug 2487050 (CVE-2026-42570) - CVE-2026-42570 devalue: devalue: Excessive memory consumption via deserialization of sparse arrays
Summary: CVE-2026-42570 devalue: devalue: Excessive memory consumption via deserializa...
Keywords:
Status: NEW
Alias: CVE-2026-42570
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-09 17:01 UTC by OSIDB Bzimport
Modified: 2026-06-11 11:17 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-06-09 17:01:40 UTC
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.


Note You need to log in before you can comment on or make changes to this bug.