CVE-2026-30226: devalue has prototype pollution in devalue.parse and devalue.unflatten
In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
Other sources
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-30226?
CVE-2026-30226 has been assessed as a moderate severity vulnerability due to its potential to cause Denial of Service (DoS) and type confusion.
How do I fix CVE-2026-30226?
To fix CVE-2026-30226, upgrade the devalue package to version 5.6.4 or later.
What versions of devalue are affected by CVE-2026-30226?
CVE-2026-30226 affects devalue versions up to and including 5.6.3.
What components are involved in CVE-2026-30226?
CVE-2026-30226 involves devalue.parse and devalue.unflatten functions that are susceptible to prototype pollution.
What types of issues can arise from CVE-2026-30226 exploitation?
Exploitation of CVE-2026-30226 can lead to Denial of Service (DoS) conditions and potential type confusion vulnerabilities.