CVE-2026-22774

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted sources. This affects applications using devalue.parse on externally-supplied data. The root cause is the typed array hydration expecting an ArrayBuffer as input, but not checking the assumption before creating the typed array. This vulnerability is fixed in 5.6.2.

• CWE-405
• CWE-405

• https://github.com/sveltejs/devalue/commit/e46afa64dd2b25aa35fb905ba5d20cea63aabbf7Patch
• https://github.com/sveltejs/devalue/releases/tag/v5.6.2Release Notes
• https://github.com/sveltejs/devalue/security/advisories/GHSA-vw5p-8cq8-m7mvVendor Advisory
• https://access.redhat.com/errata/RHSA-2026:2144
• https://access.redhat.com/errata/RHSA-2026:2926
• https://access.redhat.com/security/cve/CVE-2026-22774
• https://bugzilla.redhat.com/show_bug.cgi?id=2430095
• https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-22774.json

Published

Jan 15, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-22769Dell RecoverPoint for Virtual Machines, versions prior to 6.…10
• CVE-2026-2277The rexCrawler plugin for WordPress is vulnerable to Reflect…6.1
• CVE-2026-22770ImageMagick is free and open-source software used for editin…9.8
• CVE-2026-22771Envoy Gateway is an open source project for managing Envoy P…8.8
• CVE-2026-22772Fulcio is a certificate authority for issuing code signing c…5.3
• CVE-2026-22773vLLM is an inference and serving engine for large language m…7.5
• CVE-2026-22775Svelte devalue is a JavaScript library that serializes value…7.5
• CVE-2026-22776cpp-httplib is a C++11 single-file header-only cross platfor…7.5
• CVE-2026-22777ComfyUI-Manager is an extension designed to enhance the usab…7.5
• CVE-2026-22778vLLM is an inference and serving engine for large language m…9.8
• CVE-2026-22779BlackSheep is an asynchronous web framework to build event b…5.3
• CVE-2026-22780Rizin is a UNIX-like reverse engineering framework and comma…6.1