CVE-2026-123561: Security vulnerability

Published Nov 8, 2026

Updated

devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a proto own property, which alone does not cause prototype pollution.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade devalue to a version that resolves this vulnerability.
Fixed in 5.9.3

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Deployments using devalue versions earlier than 5.9.3 are affected when they parse attacker-controlled serialized payloads. The issue is in parse's rejection of __proto__ keys.

What does an attacker need to exploit this issue?

An attacker needs to be able to supply a crafted payload to devalue's parse functionality. The payload uses malformed null-prototype object keys and property-key coercion to bypass the __proto__ rejection.

Does successful exploitation alone cause prototype pollution?

No. The crafted payload can produce an object with an own __proto__ property, but that condition alone does not cause prototype pollution.

What is the available remediation?

Upgrade devalue to version 5.9.3 or later. The affected range is versions before 5.9.3.

CVE-2026-123561: Security vulnerability

Remediation

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Does successful exploitation alone cause prototype pollution?

What is the available remediation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

Does successful exploitation alone cause prototype pollution?

What is the available remediation?