The vulnerability originates from an unhandled promise rejection within the stringifyAsync function of the devalue library. When an asynchronous value that rejects during serialization is processed after a still‑settling promise, the internal rejection is left unhandled, which can cause the Node.js process to terminate. This leads to a denial of service, as the application crashes and becomes unavailable until the process is restarted. The weakness is categorized as CWE‑248, representing Unhandled Exception.

The flaw affects installations of devalue version 5.8.0 through 5.9.2 (inclusive). These versions are distributed by the SvelteJS project and are used by developers in Node.js applications that require serialization of complex or asynchronous data structures.

The CVSS score of 8.7 indicates a high severity impact. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Because exploitability depends on an attacker’s ability to influence the timing or failure of serialized promises, the attack vector is inferred to be local, privileged or remotely achievable only if the application exposes a mechanism to supply arbitrary promise payloads. Without such a mechanism, exploitation is unlikely. Nonetheless, any successful exploit would immediately terminate the Node.js process, causing a service outage.