devalue 5.9.2 Rejects Out-of-Bounds Indices That Made parse Quadratic

devalue.parse before 5.9.2 did not reject out-of-bounds indices. Specially crafted payloads could use that to make devalue alternate between different array representations, so the work becomes quadratic in payload size rather than linear. Fixed in 5.9.2, tracked as CVE-2026-81176 at CVSS 5.3.

Scope it exactly as the advisory does: applications are potentially affected if they call devalue.parse with untrusted data. That is a narrower condition than "SvelteKit app," and worth reading carefully. If every devalue.parse call in your app consumes a payload your own server produced, this is a dependency bump rather than an incident. If a route feeds attacker-controlled text into the deserializer, it is worth handling now.

The advisory does not state a payload size or a wall-clock figure for the slowdown, so there is no magnitude to triage against here. That absence is itself the signal: this is a low-severity parser hardening fix, not a same-day emergency, and it sits well below the critical RCE and sanitizer-bypass advisories that shipped the same week.

The bump to 5.9.2 is small and carries no API change. Take it on your next dependency pass. Worth checking whether devalue enters your tree transitively through SvelteKit's data serialization rather than as a direct dependency, since that determines whether your lockfile alone gets you there.