Sveltejs devalue versions prior to 5.9.3 include a resource exhaustion flaw. A crafted payload consisting of repeated primitive strings causes the uneval function to expand into a disproportionately large serialized string. The resulting expansion can consume excessive memory or CPU, potentially bringing affected applications or services to a halt.

The vulnerability affects the sveltejs devalue library when its version is older than 5.9.3. Any application that imports devalue and utilizes uneval on untrusted input may be impacted. Affected are projects built with sveltejs/devalue in their dependency tree until the patched release.

The CVSS v3 score of 8.7 indicates a high severity risk. EPSS information is not available, and the flaw is not listed in the CISA KEV catalog, meaning no publicly confirmed exploit activity is known. Attackers can deliver a small crafted payload, trigger uneval, and cause the application to exhaust resources. The attack vector is local or remote depending on how uneval is exposed, but the primary threat is to availability rather than confidentiality or integrity.