high7.5
CVE-2026-30226
devalue has prototype pollution in devalue.parse and devalue.unflatten
Impact
In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | devalue | < 5.6.4 | 5.6.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Svelte | Devalue | before 5.6.4 |