devalue is a serializer that converts JavaScript values to strings. The vulnerability lies in the devalue.parse function, which can consume excessive CPU time and memory when parsing certain inputs. This excessive resource usage can lead to a denial‑of‑service condition for applications that rely on devalue.parse to process potentially untrusted data.

The affected product is the Svelte devalue library, version range 5.1.0 through 5.6.1. Applications built with any of those releases that invoke devalue.parse on data coming from external sources are vulnerable. The issue is fixed in devalue 5.6.2; the library runs on Node.js environments as indicated by the CPE.

The CVSS base score of 7.5 indicates a high severity. EPSS is less than 1%, suggesting a low likelihood of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is feeding crafted input to devalue.parse, typically via an API, web form, or any untrusted data channel. Successful exploitation would consume server CPU or memory until the process becomes unresponsive, resulting in a denial of service.