{"action":"Upgrade devalue to 5.9.3 or later.","affected":[{"fixed":"5.9.3","introduced":"5.1.0"}],"component":"devalue","cve_ids":["CVE-2026-92708"],"ecosystem":"npm","epss":0.00725,"exploited":false,"fixed_versions":["5.9.3"],"ghsa_id":"GHSA-j22f-vq7h-c4qm","id":"tcs_01M5KFWHFMGHE9ZRY18W2NQYE0","modified_at":"2026-10-01T15:30:12.678757365Z","published_at":"2026-10-01T15:18:06Z","references":["https://osv.dev/vulnerability/GHSA-j22f-vq7h-c4qm","https://github.com/sveltejs/devalue/security/advisories/GHSA-j22f-vq7h-c4qm","https://nvd.nist.gov/vuln/detail/CVE-2026-92708","https://github.com/sveltejs/devalue/commit/46dc877b3570dafb1cd3291b9bb48cecef8f7266","https://github.com/sveltejs/devalue","https://github.com/sveltejs/devalue/releases/tag/v5.9.3"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-j22f-vq7h-c4qm","url":"https://osv.dev/vulnerability/GHSA-j22f-vq7h-c4qm"}],"summary":"devalue: `stringify`/`uneval` serialize shared memory"}