CVE-2026-42570

Executive Summary

CVE-2026-42570 is a high-severity (CVSS 7.5) memory exhaustion vulnerability in the Svelte devalue library, a JavaScript serialization tool used when JSON.stringify is insufficient. The flaw affects versions 5.6.3 through 5.8.0 and allows an attacker to craft a malicious payload that, when parsed by devalue.parse, causes excessive memory allocation due to quirks in JavaScript engines when handling sparse arrays. This can lead to a Denial of Service (DoS) condition by exhausting system memory. The vulnerability has been patched in version 5.8.1. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

The devalue library is distributed via npm (package name: devalue). This vulnerability introduces a supply chain risk for any application or framework (including Svelte itself) that uses the vulnerable versions of devalue to deserialize untrusted data. An attacker could inject a malicious serialized payload into an application that uses devalue.parse, potentially causing a denial of service. Organizations should audit their dependencies for devalue versions between 5.6.3 and 5.8.0 and update to 5.8.1 or later.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond the application processing the payload.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): None (N) – No data is modified.
• Availability (A): High (H) – The primary impact is a denial of service via memory exhaustion.

Threat Level: High. While no active exploitation has been observed, the low attack complexity and network attack vector make this a significant risk for applications that deserialize untrusted data using the vulnerable library.

Deep Dive & Mechanics

The vulnerability resides in the devalue.parse function, which is used to deserialize strings back into JavaScript values. The core issue is related to how the parser handles sparse arrays. In JavaScript, a sparse array is an array with missing indices (e.g., [1, , 3]). When devalue.parse encounters a serialized representation of a sparse array, it may allocate memory for all indices up to the highest index, even if most of those indices are empty. Due to quirks in certain JavaScript engines (e.g., V8, SpiderMonkey), this allocation can be significantly larger than the actual data size, leading to rapid memory consumption.

For example, a serialized payload that represents an array with a single element at index 1,000,000 could cause the parser to allocate memory for 1,000,001 elements, even though only one element is present. By crafting a payload with an extremely high index, an attacker can trigger memory exhaustion, causing the application or server to crash.

The fix in version 5.8.1 likely involves validating or limiting the size of sparse arrays during deserialization, preventing the excessive memory allocation.

Vulnerable vs. Patched Code

The exact code changes are not publicly available, but the vulnerability is in the devalue.parse function's handling of sparse arrays.

Vulnerable Code (Conceptual):

// devalue.parse (vulnerable version)
function parse(input) {
  // ... parsing logic ...
  if (type === 'array') {
    const arr = new Array(length); // Allocates memory for 'length' elements
    for (let i = 0; i < length; i++) {
      if (data[i] !== undefined) {
        arr[i] = parse(data[i]);
      }
    }
    return arr;
  }
  // ...
}

Patched Code (Conceptual):

// devalue.parse (patched version 5.8.1)
function parse(input) {
  // ... parsing logic ...
  if (type === 'array') {
    const maxIndex = Math.min(length, MAX_SAFE_ARRAY_LENGTH); // Limit the allocation
    const arr = new Array(maxIndex);
    for (let i = 0; i < maxIndex; i++) {
      if (data[i] !== undefined) {
        arr[i] = parse(data[i]);
      }
    }
    return arr;
  }
  // ...
}

The patched version introduces a limit on the array length that can be allocated, preventing the memory exhaustion attack.

Exploitation & Lab Setup

Red Team

Objective: Trigger a denial of service by sending a malicious serialized payload to an application using a vulnerable version of devalue.

Lab Setup:

1. Environment: A Node.js application that uses devalue version 5.6.3 to 5.8.0 and exposes an endpoint that deserializes user input.
2. Tooling: curl, netcat, or a custom script to send HTTP requests.

Exploitation Steps:

1. Craft a malicious payload that exploits the sparse array vulnerability. The payload should be a serialized string that, when parsed, creates a sparse array with a very high index.

   // Example payload (conceptual)
   const maliciousPayload = '[{"type":"array","length":100000000,"data":{"99999999":"x"}}]';
   

2. Send the payload to the vulnerable endpoint.

   curl -X POST http://target:3000/deserialize -H "Content-Type: application/json" -d '{"data": "[{\"type\":\"array\",\"length\":100000000,\"data\":{\"99999999\":\"x\"}}]"}'
   

3. Monitor the target system's memory usage. It should spike rapidly, potentially causing the application to crash or become unresponsive.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusually large memory allocation by Node.js processes.
• Look for requests containing serialized data with extremely large array lengths or sparse array patterns.
• Implement rate limiting and input validation on endpoints that deserialize data.

Mitigation:

• Immediately update devalue to version 5.8.1 or later.
• If immediate patching is not possible, implement a Web Application Firewall (WAF) rule to block requests containing suspiciously large array lengths in serialized data.
• Restrict the size of incoming payloads at the application or network level.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing JSON payloads with "type":"array" and "length" values exceeding 1,000,000.
  • Unusually large POST request bodies (e.g., > 10 MB) targeting deserialization endpoints.
• Host:
  • Rapid memory consumption by a Node.js process, leading to Out-of-Memory (OOM) errors.
  • Application logs showing FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory.
• File:
  • No specific file-based IOCs.

Detection Engineering

YARA Rule

rule CVE_2026_42570_Devalue_Memory_Exhaustion {
    meta:
        description = "Detects serialized payloads targeting CVE-2026-42570 in devalue library"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-42570"
        severity = "high"
    strings:
        $json_pattern = /"type"\s*:\s*"array"\s*,\s*"length"\s*:\s*\d{7,}/
    condition:
        $json_pattern
}

Sigma Rule

title: CVE-2026-42570 - Svelte Devalue Memory Exhaustion
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests containing serialized data with large array lengths indicative of CVE-2026-42570 exploitation.
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'deserialize'
        cs-body|contains: '"type":"array"'
        cs-body|contains: '"length":'
    condition: selection and (cs-body|re: '"length":\d{7,}')
falsepositives:
    - Legitimate use of large arrays in serialized data (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-42570 - Svelte Devalue Memory Exhaustion Attempt"; flow:to_server; content:"POST"; http_method; content:"deserialize"; http_uri; content:"\"type\":\"array\""; http_client_body; content:"\"length\":"; http_client_body; pcre:"/\"length\":\d{7,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Update the devalue package to version 5.8.1 or later.

   npm install devalue@5.8.1
   

2. Verify Update: Ensure no vulnerable versions remain in the dependency tree.

   npm ls devalue
   

3. Input Validation: Implement strict input validation on any endpoint that deserializes user-supplied data. Limit the maximum size of incoming payloads.
4. WAF Rules: Deploy Web Application Firewall rules to block requests containing suspicious patterns (e.g., large array lengths in JSON).
5. Monitoring: Set up monitoring for unusual memory usage patterns in Node.js applications.
6. Least Privilege: Run applications with the minimum necessary memory limits to contain the impact of a potential exploit.

Valters IT
Securing Digital Frontiers