Skip to content
fr Sign in
6.3 Medium

CVE-2026-30226 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for…

Description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.

Affected products and versions

Product Affected versions Fixed in
devalue 5.6 earliest → < 5.6.4 5.6.4

References

Timeline

  1. Published
  2. Last modified

Other CVEs of devalue

The 7 CVEs of devalue →
CVE-2026-92708 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High CVE-2026-81176 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 5.3 Medium CVE-2026-42570 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High CVE-2026-22775 Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for… 7.5 High
Track this CVE