CVE-2026-123562

Published 8 November 2026 · tracked since 8 November 2026

Description

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker ab

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-113364
• CVE-2026-113363
• CVE-2026-113362
• CVE-2026-124502 MEDIUM 4.3
• CVE-2026-124500 MEDIUM 6.3
• CVE-2026-124499 MEDIUM 4.7
• CVE-2026-18893 HIGH 7.1
• CVE-2026-18546 MEDIUM 5.4
• CVE-2026-120113 MEDIUM 6.4
• CVE-2026-116500 MEDIUM 6.2

→ Open the live CVE board · all tools