Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
Published: 2026-09-18
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: Information Disclosure in server-side code
Action: Patch Immediately
AI Analysis

Impact

The devalue library mistakenly serializes any typed array as a full ArrayBuffer, so a Node Buffer’s shared backing store exposes unrelated data such as other users' request bodies or Authorization headers. Each render that serializes a Buffer can leak up to 64 KB of untrusted process memory without authentication, constituting a classic information exposure (CWE-200), misuse of process-scope storage (CWE-226), and inadequate handling of user‑controlled data (CWE-201).

Affected Systems

Svelte devalue library versions 5.1.0 through 5.9.2 are affected. Projects that embed devalue on the server—such as SvelteKit or Nuxt applications that serialize Buffers in load() or similar server‑side render paths—are vulnerable. The vendor is sveltejs:devalue.

Risk and Exploitability

With a CVSS score of 7.5 the flaw is high severity, but its EPSS score is less than 1%, indicating a low current exploitation probability. It is not listed in the CISA KEV catalog. An attacker can trigger the bug by causing a server‑side render that includes a user‑controlled or small Buffer; the flaw executes whenever serialization occurs and therefore repeatedly leaks memory.

Generated by OpenCVE AI on September 23, 2026 at 01:36 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the devalue package to version 5.9.3 or later, which removes the faulty ArrayBuffer serialization.
  • If an upgrade is not immediately possible, convert any Node Buffer objects to Uint8Array before passing them to stringify() or uneval().
  • Audit all server‑side rendering code (e.g., load() functions in SvelteKit or Nuxt) to ensure no Buffer instances are unintentionally serialized, and adjust logic to avoid serializing sensitive data.

Generated by OpenCVE AI on September 23, 2026 at 01:36 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory
History

Wed, 23 Sep 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 23 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-201
References
Metrics threat_severity

None

 threat_severity

Important

Sat, 19 Sep 2026 22:15:00 +0000

Type Values Removed Values Added
First Time appeared Svelte
Svelte devalue
Vendors & Products Svelte
Svelte devalue

Fri, 18 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.
Title devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Weaknesses CWE-200
CWE-226
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Svelte Devalue
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-23T19:38:36.551Z

Reserved: 2026-09-16T16:22:31.542Z

Link: CVE-2026-92708

cve-icon Vulnrichment

Updated: 2026-09-23T19:38:32.247Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-09-18T20:17:30.150

Modified: 2026-09-23T20:17:22.253

Link: CVE-2026-92708

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-18T19:54:28Z

Links: CVE-2026-92708 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-23T01:45:19Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-201

    Insertion of Sensitive Information Into Sent Data

  • CWE-226

    Sensitive Information in Resource Not Removed Before Reuse