Advisory · CVE-2026-123562
devalue can crash Node.js processes through unhandled promise rejections
devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled even if the caller catches the returned promise, letting an attacker able to influence the timing or failure of serialized asynchronous values terminate the Node.js process, rated high at CVSS 8.7 under version 4.0; fixed in 5.9.3.
- Vendor
- sveltejs
- Product
- devalue
- Identifier / CWE
- CVE-2026-123562
CWE-248 - Action timing
- Immediate
Explain it like I’m five
devalue packs JavaScript values for transport, including promises. If one promise fails at the wrong moment, the error escapes every safety net and kills the whole Node.js process.
- 01Promises serialized
An application passes multiple promises to devalue stringifyAsync.
- 02Later promise rejects early
A rejection lands before an earlier promise settles.
- 03Rejection escapes
The internal rejection goes unhandled even though the caller catches the returned promise.
- 04Process terminates
The unhandled rejection kills the Node.js process.
What happened
devalue 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process. The record rates it high at CVSS 8.7 under version 4.0, with network attack vector, low complexity, no privileges required, and no user interaction.
devalue ships with SvelteKit, so the blast radius is every SvelteKit server that serializes attacker-influenced async values. This is one of several denial-of-service flaws in devalue fixed in 5.9.3. The flaw is fixed in 5.9.3.
What to do
- Inventory applications using devalue, including SvelteKit deployments, and record each version.
- Upgrade devalue to 5.9.3 or later.
- Monitor Node.js processes for unhandled rejection crashes around serialization paths.
- Verify the deployed version after updating.
Management note
A crash bug in a serialization library bundled with a major framework is a dependency-update task, not an application bug. Bump devalue and let the framework carry the fix.