CVE-2026-123567: Security vulnerability

Published Nov 8, 2026

Updated

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject proto own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

Event History

Nov 8, 2026

CVE Published

via NVD·02:16 AM

Data Sourced

via NVD·02:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to exploitation?

Applications using a devalue version before 5.6.4 are exposed when they process attacker-controlled serialized input with devalue.parse or devalue.unflatten and then merge the returned object using Object.assign.

What must an attacker be able to do?

An attacker needs to supply crafted serialized input that reaches devalue.parse or devalue.unflatten. The impact occurs when downstream code uses Object.assign to merge the parsed or unflattened result into another object.

How can I determine whether my application is affected?

Check whether your installed devalue version is earlier than 5.6.4. Review uses of devalue.parse and devalue.unflatten to determine whether they accept untrusted input and whether their returned objects are subsequently merged with Object.assign.

CVE-2026-123567: Security vulnerability

Event History

Frequently Asked Questions

Which applications are exposed to exploitation?

What must an attacker be able to do?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to exploitation?

What must an attacker be able to do?

How can I determine whether my application is affected?