Devalue before 5.9.3 contains a validation bypass that allows custom ArrayBuffer revivers to skip typed‑array allocation checks in the parse function. Attackers can supply a very small crafted input processed by a malformed reviver to allocate an arbitrarily large ArrayBuffer, exhausting memory and causing a denial of service.

The vulnerability affects the Devalue library from SvelteJS. All releases prior to version 5.9.3 are vulnerable. No later releases contain the fix.

The CVSS score of 8.7 classifies the issue as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but that does not reduce the potential impact. Attackers can trigger the flaw by providing a crafted string to parse, which may be feasible remotely if the application uses devalue to process untrusted input. The attack requires only a specially crafted reviver and input; once triggered, it can exhaust system memory and make the process unavailable.