CVE-2026-42570: Svelte devalue: DoS via sparse array deserialization

Synopsis

A denial-of-service vulnerability exists in the Svelte devalue JavaScript library, affecting versions 5.6.3 through 5.8.1. The flaw is reachable over the network without any authentication, and exploits a quirk in certain JavaScript engines where deserializing a crafted sparse array causes devalue.parse to allocate far more memory than necessary, exhausting available memory on the host. Successful exploitation crashes or degrades the affected service. Note: the description states the issue has been patched in version 5.8.1, though no fix version has been formally published to the advisory record yet; HarborGuard is tracking the advisory for confirmed patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable deserialization path is exposed over the network, so an attacker must be able to send crafted input to the service from a remote network location.

• AuthenticationNot required

  No credentials or account of any kind are needed to send the malicious payload to the affected endpoint.

• Victim interactionNot required

  The attacker does not need any user or administrator to take an action; submitting the crafted input is sufficient to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race condition, memory layout dependency, or other environmental factor needs to be satisfied to trigger the excessive allocation.

Blast Radius

• Triggers unbounded memory allocation inside the JavaScript engine process handling devalue.parse, consuming available heap until the process is killed or becomes unresponsive.
• Crashes or permanently degrades the affected Svelte application or API server, making it unavailable to legitimate users.
• In shared-runtime environments (for example, a Node.js server handling multiple tenants), a single malicious request can deny service to all concurrent users of that process.