HIGH 8.7 NVD
CVE-2026-123562
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rej
devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.
References
- https://github.com/sveltejs/devalue/security/advisories/GHSA-x5rw-q4pp-hg5g
- https://www.vulncheck.com/advisories/devalue-5.8.0-before-5.9.3-denial-of-service-via-stri
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-11-08 via NVD.
vulnfeed aggregates 16937 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.