CVE-2026-30226

The record

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.

Affected packages

Related vulnerabilities

• GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten Same vulnerability
• CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
• GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization Also affects devalue
• GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__`… Also affects devalue
• GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays Also affects devalue
• GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Also affects devalue
• GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Also affects devalue
• GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse Also affects devalue