CVE-2026-123565
HIGH
NVD
CVSS Score
7.5
Severity
HIGH
Published
Nov 08, 2026
Vendor
unknown
Description
Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause quadratic expansion in the uneval function. Attackers can supply a small crafted payload that is parsed and then passed to uneval, producing a very large serialized string that exhausts memory or CPU.