# CVEs affecting the Svelte ecosystem

DevFeed: [CVEs affecting the Svelte ecosystem](<https://devfeed.tech/articles/cves-affecting-the-svelte-ecosystem-3030.md>)

Original publisher: [Read original article](<https://svelte.dev/blog/cves-affecting-the-svelte-ecosystem>)

Author: Elliott Johnson

Published: 2026-01-15T00:00:00Z

Content type: news

Language: en

Sources: [Svelte blog](<https://devfeed.tech/sources/svelte-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Web Development](<https://devfeed.tech/topics/web-development.md>)

Tags: [ecosystem](<https://devfeed.tech/tags/ecosystem.md>), [security](<https://devfeed.tech/tags/security.md>), [svelte](<https://devfeed.tech/tags/svelte.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

## AI overview

Svelte reports patches for five vulnerabilities affecting devalue, svelte, SvelteKit, and the Node adapter. Developers using the affected packages should upgrade to the listed non-vulnerable versions; the advisory highlights denial-of-service risks involving user-controlled input and remote functions.

## Source excerpt

We've released patches for 5 vulnerabilities across devalue, svelte, @sveltejs/kit, and @sveltejs/adapter-node. Here's what you need to know: Upgrade now If you're using any of these packages, upgrade them to their corresponding non-vulnerable versions: devalue: 5.6.2 svelte: 5.46.4 @sveltejs/kit: 2.49.5 @sveltejs/adapter-node: 5.5.1 For cross-dependent packages -- svelte and @sveltejs/kit depend on devalue -- patched versions already include upgraded dependencies. Commentary We're extremely thankful to all of the security researchers who responsibly disclosed these vulnerabilities and worked with us to get them fixed, to the security team at Vercel who helped us navigate the disclosure process, and to the maintainers who worked to publish the fixes. Over the last few weeks, we've seen a spate of high profile vulnerabilities affecting popular tools across the web development ecosystem. While they are unfortunate, it has been encouraging to see the community pulling together to keep end users safe. Using the lessons learned from these vulnerabilities, we will invest in processes that will help catch future bugs during the writing and review phases, before they go live. If you think you have discovered a vulnerability in a package maintained by the Svelte team, we urge you to privately report it via the Security tab on the repo in question (or the Svelte repo, if unsure). Details Full reports are available in the published security advisories, but we've included a brief summary of each below. CVE-2026-22775: DoS in devalue.parse due to memory/CPU exhaustion Packages affected: devalue You're affected if: You're using devalue versions 5.1.0 through 5.6.1, and You're parsing user-controlled input Effects: A malicious payload can cause arbitrarily large memory allocation, potentially crashing the process SvelteKit applications using remote functions are vulnerable, as the parameters are run through devalue.parse If you don't have remote functions enabled, SvelteKit is not v