CVE•Published 2026-01-15•Modified 2026-07-15•0 articles on news•4 live references•NVD data

CVE-2026-22775Svelte · Devalue

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS percentile

Exploit Prediction Scoring System · top 57% of all CVEs

Weaknesses (CWE)

CWE-405Asymmetric Resource Consumption (Amplification)

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the ArrayBuffer hydration expecting base64 encoded strings as input, but not checking the assumption before decoding the input. This vulnerability is fixed in 5.6.2.

Timeline

Published 2026-01-15

Modified 2026-07-15

External references

NVD MITRE Exploit-DB VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common). Live host counts are a Premium feature.

Shodan · vuln tag

vuln:CVE-2026-22775

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Svelte Devalue"

All exposed Svelte Devalue instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Devalue"

HTTP body or banner mentions "Devalue" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2026-22775