Résumé
Svelte devalue: DoS via malformed input
Détails de l’avis
Impact
devalue.parse prior to version 5.9.2 fails to reject out-of-bounds indices. Specially-crafted payloads can exploit this to cause devalue to alternate between different array representations, resulting in work that is quadratic with payload size.
Applications are potentially affected if they call devalue.parse with untrusted data.
Patches
The bug is fixed in devalue@5.9.2.
Références
- https://github.com/advisories/GHSA-9rgm-9g3h-6x36
- https://github.com/sveltejs/devalue/security/advisories/GHSA-9rgm-9g3h-6x36
- https://nvd.nist.gov/vuln/detail/CVE-2026-81176
- https://github.com/sveltejs/devalue/commit/8b2a4562c446d7c36d9d629778079a5fae4243e1
- https://github.com/sveltejs/devalue/releases/tag/v5.9.2
Vulnérabilités liées
Tout Supply chain →- MEDIUMCVE-2026-102682
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
- MEDIUMCVE-2026-100350
kin-openapi deepObject query decoding repeatedly compiles an invariant regular expression
- MEDIUMCVE-2026-59951
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
- HIGHCVE-2026-104827
react/http: Unbounded HTTP Client Response Header Buffering Leads to Memory Exhaustion DoS
- HIGHCVE-2026-77622
Sliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG Decoder
- HIGHCVE-2026-72923
Microsoft.OpenApi.YamlReader vulnerable to denial of service via YAML alias expansion