CVE-2026-92708 - devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
Brief
CVE ID : CVE-2026-92708
Published : Sept. 18, 2026, 8:17 p. m.
- 39 minutes ago
Description : Svelte devalue is a JavaScript library that serializes values into strings when JSON. stringify isn't sufficient for the job. In versions 5.
- 0 through 5.
- 2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests.
In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication.