devalue.parse, a function in the Svelte devalue library, can consume excessive CPU time and memory when processing certain inputs. This leads to a denial of service in systems that parse untrusted data with devalue.parse. The weakness is due to unvalidated typed array hydration that expects an ArrayBuffer, causing resource exhaustion. The impact is a loss of availability for applications that rely on this parsing function, and the vulnerability is fixed in version 5.6.2.

Affected applications include those using the Svelte devalue JavaScript library in the Node.js environment, specifically versions 5.3.0 through 5.6.1 inclusive. Any software that calls devalue.parse with externally supplied data is vulnerable. Systems employing these library versions in a browser or server context may be impacted.

CVSS score 7.5 indicates high severity. EPSS < 1% suggests a low probability of exploitation, yet the vulnerability can be triggered by crafting malicious input to devalue.parse. The attack vector is likely remote when the application accepts network input that feeds the parser. The vulnerability is not listed in the CISA KEV catalog, but still poses a significant risk to availability for exposed services. Immediate remediation is advised to mitigate potential denial of service.