GHSA-mwv9-gp5h-frr4
NoneCVSS
—
EPSS
—
Published
Mar 12, 2026
CISA due date
—
The record
Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | devalue | 4.0.0 | 5.6.4 |
Related vulnerabilities
- CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization Also affects devalue
- GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten Also affects devalue
- CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when… Also affects devalue
- GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays Also affects devalue
- GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed Also affects devalue
- GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse Also affects devalue
- GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse Also affects devalue