Search

CVE-2026-92708 - devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

CVE ID : CVE-2026-92708 Published : Sept. 18, 2026, 8:17 p. m. • 39 minutes ago Description : Svelte devalue is a JavaScript library that serializes values into strings when JSON. stringify isn't sufficient for the job. In versions 5. 1. 0 through 5. 9. 2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication.