CVE-2026-92708
1 advisory.
npm/devalue CVE-2026-92708: high 7.5
devalue: `stringify`/`uneval` serialize shared memory
Action: Upgrade devalue to 5.9.3 or later.
npm i devalue@5.9.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.1.0 | 5.9.3 | - |
Fixed versions
| 5.9.3 |
Sources
- osv: GHSA-j22f-vq7h-c4qm
- https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm
- https://nvd.nist.gov/vuln/detail/CVE-2026-92708
- https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266
- https://github.com/sveltejs/devalue
- https://github.com/sveltejs/devalue/releases/tag/v5.9.3
CVE-2026-92708 · published · modified · JSON