{"id":"CVE-2026-123563","aliases":["GHSA-r9w8-h9r3-54w4"],"url":"https://o3.security/vulnerability/CVE-2026-123563","summary":"Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse","details":"Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip typed-array allocation checks in the parse function. Attackers can supply very small crafted input processed by a malformed ArrayBuffer reviver to allocate massive ArrayBuffers, causing memory exhaustion and denial of service.","published":"2026-11-08T01:38:03.120Z","modified":"2026-11-09T02:47:17.732047175Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"devalue","fixedVersion":"5.9.3"}],"fix":{"url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99","label":"sveltejs/devalue@8f8d78e"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/123xxx/CVE-2026-123563.json"},{"type":"ADVISORY","url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-r9w8-h9r3-54w4"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123563"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/devalue-before-5.9.3-typed-array-allocation-validation-bypass-via-parse"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/commit/8f8d78e173f8a00023d009c7677ccc600dee0b99"},{"type":"PACKAGE","url":"https://github.com/sveltejs/devalue"},{"type":"WEB","url":"https://github.com/sveltejs/devalue/releases/tag/v5.9.3"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-09T02:47:17.732047175Z"}}