CVE-2026-92708

Overview

Svelte devalue library versions 5.1.0–5.9.2 incorrectly serialize Node Buffer objects, exposing up to 64 KB of unrelated process memory. This flaw can leak request bodies or headers from other users in server‑side rendered pages. The issue is fixed in 5.9.3.

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.

Impact

The vulnerability discloses confidential data from other users’ requests, compromising confidentiality. It affects any application that serializes Buffers on the server side, including SvelteKit and Nuxt sites. Developers and site operators must be aware that untrusted data can be inadvertently exposed to end‑users.

Remediation

Upgrade Svelte devalue to 5.9.3 or later. For legacy versions, convert all Node Buffer instances to Uint8Array before calling stringify or uneval. Review server‑side rendering code to ensure no Buffer objects are serialized to client output.

Risk context

High severity (CVSS 7.5) with no EPSS data; the flaw is active in widely used frameworks, making it a timely concern for production deployments.

Affected products

• SvelteKit
• Nuxt
• Svelte devalue