Svelte devalue is a JavaScript library that serializes and deserializes values. Between versions 5.6.3 and before 5.8.1, the parse function could be manipulated by supplying a sparse array that, due to quirks in certain JavaScript engines, causes the function to allocate far more memory than the array actually contains. This excessive memory consumption can lead to service disruption or system crashes, exemplifying a denial‑of‑service vulnerability (CWE‑770).

The affected product is sveltejs:devalue, specifically versions from 5.6.3 through the last release prior to 5.8.1. All earlier releases are not impacted, and the issue has been resolved in version 5.8.1.

The CVSS score of 7.5 indicates a moderate‑to‑high severity of the flaw. While an EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the ability to trigger memory exhaustion is present. The likely attack vector involves an attacker providing a specially crafted sparse array to the devalue.parse routine, which may be reachable through any user‑controlled input endpoint or embedded script. Successful exploitation would consume application or system memory, potentially causing a crash or degraded performance.