The vulnerability is a denial of service in the devalue library prior to version 5.9.3, caused by the uneval function processing sparse arrays. By crafting an array with a large declared length but few initialized elements, an attacker can trigger synchronous CPU work proportional to the array length, blocking the JavaScript event loop. This flaw is a resource exhaustion weakness (CWE-400).

The affected product is SvelteJS’s devalue library, any installation using a version earlier than 5.9.3. This includes all projects that depend on the library without upgrading to the 5.9.3 release or later, in both client‑side and server‑side contexts.

The CVSS score of 8.7 classifies the issue as high severity. No EPSS score is available, and it is not listed in the CISA KEV catalog, indicating limited public exploitation to date. However the uneval function can be invoked when processing external input, allowing a remote attacker to supply a crafted sparse array that can exhaust CPU resources and block the event loop. The attack is primarily a denial of service, impacting availability without affecting confidentiality or integrity. The vectors are likely remote through exposed endpoints that use devalue on untrusted data, but a local privileged attacker could also trigger the fault if the library is used within a privileged application.