The vulnerability resides in the Sveltejs devalue library, specifically in the uneval function. A memory exhaustion flaw occurs when the generated code for sparse arrays allocates memory proportional to the array’s declared length during evaluation. Attackers who can influence a large sparse array that an application serializes can force the browser or runtime to consume excessive memory when the serialized output is evaluated, potentially crashing the application or browser.

Versions of sveltejs:devalue from 1.0.0 up to and including 5.9.2 are impacted. The advisory indicates that the issue is fixed in 5.9.3 and later. No other product versions are listed as affected.

The CVSS score of 8.7 places this issue in the high severity range, and although no EPSS score is available, memory exhaustion can lead to denial of service. The likely attack vector is an application that passes untrusted data to devalue’s uneval and then evaluates the output in a browser or runtime environment. If a malicious user can craft a very large sparse array to be serialized, the resulting evaluation can exhaust available memory, disrupt normal operation, or crash the client.