The devalue library for npm prior to version 5.6.3 contains a flaw that can trigger a denial of service by consuming excessive CPU and memory when serializing sparse arrays via uneval or stringify. The flaw is a resource exhaustion weakness, classified as CWE‑770. An attacker who manages to create a sparse array on the server and force its serialization can exhaust critical resources, causing the application to become unresponsive or crash.

SvelteJS's devalue JavaScript library used in npm packages is vulnerable. All installations using devalue earlier than version 5.6.3 are affected. No further version details were supplied beyond the pre‑5.6.3 range.

The CVSS score is 8.7, indicating a high severity. The EPSS score is not available, and the issue is not listed in the CISA KEV catalog. The vulnerability can be exploited if an attacker can create a sparse array on the server and force serialization via devalue's uneval or stringify. Mainstream wire formats normally reject sparse arrays, so a custom data payload or an application that accepts arbitrary array data from an external source is required. The risk is high when these conditions are met, but the exploitability is constrained by the need for such a crafted input. Since the EPSS score is not available and the issue is not in the KEV catalog, the probability of widespread exploitation remains uncertain.