CVE-2026-81176

Executive Summary

CVE-2026-81176 is a denial-of-service weakness in the JavaScript library devalue, a serializer/deserializer commonly used with Svelte applications to transport structured data between server and client. Prior to version 5.9.2, the devalue.parse function fails to reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js, allowing a crafted payload to force the parser to alternate between array representations and produce quadratic computational work as input size grows. Applications that pass untrusted data into devalue.parse can be driven into CPU exhaustion, degrading or halting service availability. The vulnerability is network-reachable, requires no authentication or user interaction, and is scoped to availability impact only (CVSS 3.1 base 5.3).

Technical Analysis

devalue exists to serialize values that JSON.stringify cannot represent faithfully, such as cyclical references, Map, Set, Date, and other non-JSON types. Its parser reconstructs these structures from a string representation, resolving references by index into an internal values table. The parser logic resides in src/parse.js, and the defect centers on a missing bounds check.

Per the NVD description, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length. In a correctly bounded parser, any index referencing a slot at or beyond the current values length would be treated as malformed and rejected. Because this validation is absent in vulnerable versions, a specially crafted untrusted payload can make the parser alternate between array representations. This alternation causes the parser to perform increasing amounts of work as the payload grows — specifically quadratic work in the size of the payload — which manifests as algorithmic complexity exhaustion (a "quadratic blowup" DoS).

The vulnerability class is CWE-770 (Allocation of Resources Without Limits or Throttling), a category covering resource-consumption conditions where an attacker can cause disproportionate CPU or memory usage from a comparatively small input via unbounded or unbounded-by-design processing. Here, the resource is CPU time consumed by repeated parser passes triggered by the malformed index handling. The attack surface is any application endpoint, API, worker, or edge/browser context where untrusted input flows into devalue.parse. In SvelteKit-style architectures, devalue is commonly used to serialize form/action data and hydration payloads, broadening the realistic exposure surface to user-submitted data paths.

Important constraints on the technical claims available: the NVD description does not disclose the exact payload grammar, the specific expression that produces the array-representation alternation, or the precise code construct in src/parse.js that omits the length check. This report intentionally avoids inventing such details. What is provable from the data: the file is src/parse.js, the missing validation concerns indices >= values.length, the effect is quadratic time complexity, and the fix landed in 5.9.2.

CVSS 3.1 breakdown as scored: AV:N (remotely reachable), AC:L (no special conditions), PR:N (no privileges), UI:N (no interaction), S:U (impact confined to the vulnerable component), C:N/I:N (no confidentiality or integrity loss), A:L (limited availability impact). The A:L reflects a resource-exhaustion DoS that degrades availability rather than guaranteed full outage.

Exploitation Scenarios

No public proof-of-concept, exploit code, or Nuclei template exists for this CVE. The following chain is inferred strictly from the vulnerability class and the NVD description; specific payload syntax is not disclosed and is not fabricated here.

1. Reconnaissance / target identification. The attacker identifies applications that consume devalue-formatted data from untrusted sources. Indicators include Svelte/SvelteKit deployments, hydration payloads, form action endpoints, and public APIs that accept serialized structured data. Shodan-style fingerprinting of Svelte-served applications and HTML containing devalue artifacts helps enumerate candidate targets.

2. Triggering the flaw class. The attacker supplies a crafted payload containing indices that are greater than or equal to values.length — i.e., references to positions that do not exist in the values table. Because vulnerable devalue.parse (prior to 5.9.2) does not reject these out-of-bounds indices, the parser continues processing.

3. Payload/execution at the vulnerability-class level. The attacker structures the payload so that the parser alternates between array representations as it resolves the malformed references. Each additional element increases the amount of parsing work non-linearly — quadratic in payload size — so the attacker does not need a very large payload to induce significant CPU consumption. Execution occurs server-side (or in any context that calls devalue.parse on the untrusted input) as a normal request/data-processing cycle.

4. Post-exploitation impact. The primary effect is CPU exhaustion and latency inflation in the parsing process. In a web context this translates to slow or unresponsive endpoints, blocked event-loop work, degraded throughput for legitimate users, and potential cascading failures if the worker/process is a shared bottleneck. No confidentiality or integrity impact is expected because the flaw is a complexity/allocation condition, not a memory-safety or injection issue.

Because there is no public exploit, defenders should treat exploit attempts as low-complexity but low-maturity: an attacker who understands the serializer grammar can craft payloads manually. The discriminating signal is not a known payload signature but anomalous parse cost relative to input size.

Impact Assessment

Business impact centers on availability. A successful attack against an exposed parsing path can cause process-level CPU saturation, request timeouts, elevated latency, and potential service unavailability until the offending request completes or is terminated. Because the CVSS vector is S:U (scope unchanged) with C:N/I:N, the blast radius is confinement of damage to the vulnerable parsing component rather than lateral movement or data exposure.

Affected systems are those shipping devalue prior to 5.9.2 in a path that parses untrusted data — most notably Svelte and SvelteKit applications that deserialize client- or user-supplied structures, plus any Node.js service using the library for inter-process or API serialization. The blast radius scales with topology: a single parsing worker on a synchronous event loop can be monopolized by one crafted request, affecting all tenants served by that process. Multitenant or shared-runtime deployments therefore face amplified availability risk compared to isolated, horizontally scaled workers with strict request timeouts.

Prioritization is moderate. With base 5.3, network reachability, no authentication, and trivial complexity, the exploitability is high even though the impact is limited to availability. EPSS has not yet been scored by FIRST.org; no forecast value is asserted. CISA KEV does not list this CVE, and there is no evidence of known exploitation in the wild. Risk is highest for internet-exposed parsing endpoints and lowest for internal-only, single-user tooling.

Detection Guidance

Sigma Rule

title: Potential devalue.parse Quadratic DoS via Out-of-Bounds Indices (CVE-2026-81176)
id: 8f2c9a41-7d3e-4b1a-9c6e-1a2b3c4d5e6f
status: experimental
description: Detects application-level indicators consistent with crafted devalue payloads that reference out-of-bounds indices, causing quadratic parsing work in vulnerable versions (< 5.9.2).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-81176
author: valtersit.com
date: 2026/01/01
logsource:
  category: application
  product: nodejs
detection:
  selection_content:
    - 'devalue'
    - 'values.length'
  selection_error:
    - 'parse'
  selection_anomaly:
    - 'high_cpu'
    - 'request_timeout'
    - 'event loop lag'
  condition: selection_content and selection_error
falsepositives:
  - Legitimate devalue traffic during heavy load
  - Application logging that includes library names
level: low
tags:
  - attack.t1190
  - cve.2026-81176

YARA Rule

rule CVE_2026_81176_devalue_oob_indices
{
    meta:
        description = "Detects devalue payloads referencing out-of-bounds value indices associated with CVE-2026-81176"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-81176"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $devalue = "devalue" ascii wide nocase
        $parse   = "parse"   ascii wide
        $idx     = /\[[0-9]{3,}\]/ ascii

    condition:
        $devalue and $parse and #idx > 5
}

Note: payload grammar is not publicly documented; this rule targets high indices co-occurring with devalue markers and is heuristic, not signature-exact.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-81176 devalue.parse Out-of-Bounds Index DoS Attempt"; flow:established,to_server; http.method; content:"POST"; http.request_body; content:"devalue"; content:"["; pcre:"/(?:\\[[0-9]{3,}\\]){3,}/"; threshold:type both, track by_src, count 10, seconds 60; classtype:attempted-dos; sid:202681176; rev:1; reference:cve,2026-81176;)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name == "node" and process.command_line : "*devalue*"]
  [process where event.action == "end" and process.name == "node"]

Interpretation: elevated-frequency short-lived parse-heavy node processes or sustained CPU bursts tied to devalue-processing services indicate an abnormal parsing workload. Correlate with request logs tagged devalue/hydration. EQL cannot inspect payload indices directly unless the serialized body is logged.

Splunk SPL Query

index=web OR index=app source=*node* OR source=*svelte*
| eval payload_len = len(coalesce(http_request_body, body, ""))
| where match(coalesce(http_request_body, body, ""), "devalue")
| stats count avg(payload_len) max(payload_len) by src_ip, uri_path
| where max(payload_len) > 1000 AND count > 20
| sort - count

Wazuh OSSEC Rule

<group name="cve_2026_81176,devalue,dos,">
  <rule id="100811" level="10">
    <decoded_as>json</decoded_as>
    <field name="message">devalue</field>
    <field name="message">values.length</field>
    <description>CVE-2026-81176: potential devalue.parse out-of-bounds index DoS attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100812" level="8">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="message">devalue</field>
    <description>CVE-2026-81176: devalue payload observed in POST body</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The NVD description states the issue is fixed in devalue 5.9.2, but no corroborated vendor advisory, commit reference, or tracked patch source is available. Treat this as an unverified remediation claim pending independent confirmation; validate the resolved package version in your lockfile before relying on it.

1. Immediate mitigations:

   • Do not pass untrusted input directly into devalue.parse. Restrict parsing to trusted, internal data sources where feasible.
   • Impose strict input size limits and schema validation on any endpoint that accepts serialized structured data, rejecting oversized or structurally anomalous payloads before they reach the parser.
   • Enforce request timeouts and CPU quotas at the reverse-proxy, runtime, or container level (e.g., cgroup CPU limits) to bound the impact of a slow parse.
   • Isolate parsing work from latency-critical event loops — offload to worker threads or separate processes — so a single crafted request cannot monopolize a shared runtime.
   • Apply rate limiting per source to inhibit repeated DoS attempts.

2. Patch/upgrade steps:

   • Upgrade devalue to 5.9.2 or later, per the version referenced in the NVD description.
   • Regenerate lockfiles and re-run dependency audits; verify transitive Svelte/SvelteKit dependency trees resolve to a non-vulnerable devalue version.
   • Because patch confidence is 0/4, independently confirm the fix release exists and inspect its contents before declaring remediation complete.

3. Long-term hardening:

   • Add dependency version pinning and automated SCA monitoring for devalue and the Svelte ecosystem.
   • Adopt resource-exhaustion guardrails as standard: bounded parsers, input caps, and algorithmic-complexity testing in CI.
   • Fuzz and load-test deserialization paths with malformed index inputs to catch similar CWE-770 conditions early.

References

• NVD — CVE-2026-81176: https://nvd.nist.gov/vuln/detail/CVE-2026-81176
• devalue project repository (source of src/parse.js and the 5.9.2 fix): https://github.com/sveltejs/devalue
• CWE-770 — Allocation of Resources Without Limits or Throttling: https://cwe.mitre.org/data/definitions/770.html
• FIRST EPSS — not yet scored for this CVE (no score asserted)
• CISA KEV Catalog — CVE-2026-81176 not listed (no in-the-wild exploitation evidence)

Threat actor note: no known threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-81176 at the time of writing. No public PoC, exploit code, or Nuclei template is available; references to cve,2026-81176 in generated detections are placeholders pending NVD publication of full metadata.