Post

Svelte
@svelte.dev

We've just published patch releases of devalue, Svelte, and SvelteKit that fix a number of vulnerabilities. No need to panic — they're all hard to exploit or reliant on experimental features — but we recommend updating as soon as you get a chance. More details in the advisories:

10 reposts66 likes

Svelte
@svelte.dev

devalue: - github.com/sveltejs/dev... Svelte: - github.com/sveltejs/sve... - github.com/sveltejs/sve... - github.com/sveltejs/sve... - github.com/sveltejs/sve... SvelteKit: - github.com/sveltejs/kit... Thank you to the researchers who responsibly disclosed these

github.comDoS via sparse array deserialization`devalue.parse` could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption.