CVE-2026-22774

HIGH

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume e...

Affects 1 product across 1 vendor.

CVSS 3.17.5
EPSS0.6%
Percentile49th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, no confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-405: CWE-405
◆ AI Analysis — automated analysis, not human-reviewed

CVE-2026-22774 affects Svelte devalue versions 5.3.0 to 5.6.1, where certain inputs can cause excessive CPU time and/or memory consumption, leading to potential denial of service in systems parsing untrusted data.

BSID: BS-2026-GLOBAL-069284-H • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2026-22774?
CVE-2026-22774 affects Svelte devalue versions 5.3.0 to 5.6.1, where certain inputs can cause excessive CPU time and/or memory consumption, leading to potential denial of service in systems parsing untrusted data.
What is the CVSS score for CVE-2026-22774?
CVE-2026-22774 has CVSS 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS: 0.6%.
Is CVE-2026-22774 actively exploited?
No confirmed active exploitation of CVE-2026-22774 as of 2026-09-25.
How do I remediate CVE-2026-22774?
Priority: HIGH.
What systems are affected by CVE-2026-22774?
CVE-2026-22774 affects Svelte Devalue.
Vulnerability Details
CVE IDCVE-2026-22774
BSIDBS-2026-GLOBAL-069284-H BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published2026-01-15
Last Modified2026-07-15
ICS Relevance0%
Weakness (CWE)
CWE-405
SourceNVD
Official Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking the assumption before creating the typed array. This vulnerability is fixed in 5.6.2.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Attackers can exploit this vulnerability by providing specially crafted input to the devalue.parse function, causing the system to consume excessive resources and potentially leading to a denial of service condition.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Svelte Devalue ≥ 5.3.0, < 5.6.2
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 273 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash2c287410fc3f2b37e0321458985df851b52c845c0541e4ee4b1acda0769b66a385e518bb42c8f0e53994dd11ad8e95f960020cd75ced889f6f81ef1600b8c0b3
Related CVEs affecting Svelte
CVE-2025-67647 9.1 SvelteKit is a framework for rapidly developing robust, performant web applic... CVE-2023-29003 8.8 SvelteKit is a web development framework. The SvelteKit framework offers deve... CVE-2023-29008 8.8 The SvelteKit framework offers developers an option to create simple REST API... CVE-2021-29261 7.8 The unofficial Svelte extension before 104.8.0 for Visual Studio Code allows ... CVE-2024-23641 7.5 SvelteKit is a web development kit. In SvelteKit 2, sending a GET request wit...
View all Svelte CVEs →

ICS/OT Vulnerability Intelligence for Your Environment

BreachSpider tracks 384,000+ CVEs and matches them to your ICS/OT assets by exact version, with AI analysis, NERC CIP mapping, and vendor PSIRT contacts.

Create a free account →