{"id":"CVE-2026-30226","aliases":["CLSA-2026-1786357331","EUVD-2026-11253","GHSA-33hq-fvwr-56pm","GHSA-8qm3-746x-r74r","GHSA-cfw5-2vxh-hr84","GHSA-mwv9-gp5h-frr4","ROOT-APP-NPM-CVE-2026-30226"],"status":"published","title":"devalue has prototype pollution in devalue.parse and devalue.unflatten","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00471,"percentile":0.41151,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-03-11T17:47:40Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"npm","package":"devalue","fixed_in":["5.6.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"@rootio/devalue","fixed_in":["4.3.3-root.io.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"devalue","fixed_in":["4.3.3-aikido.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.6.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.3.2-tuxcare.0"},{"fixed":"4.3.2-tuxcare.1"}]}],"versions":["4.3.2"],"bundled":2},{"source":"osv","ecosystem":"npm","package":"devalue","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"5.6.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-root.io.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"devalue","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.3-aikido.1"}]}]}],"products":[{"vendor":"svelte","product":"devalue"},{"vendor":"sveltejs","product":"devalue"}],"references":[{"url":"https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-30226","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-cfw5-2vxh-hr84"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/30xxx/CVE-2026-30226.json","tags":["advisory"]},{"url":"https://github.com/sveltejs/devalue","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-30226","title":"devalue has prototype pollution in devalue.parse and devalue.unflatten","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.","status":"published","published":"2026-03-11T17:47:40.016Z","modified":"2026-03-12T13:51:34.208Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:43:56.024247Z"}],"euvd":[{"id":"EUVD-2026-11253","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.","status":"published","published":"2026-03-11T17:47:40Z","modified":"2026-03-12T13:51:34Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T19:25:36.272941Z"}],"ghsa":[{"id":"GHSA-cfw5-2vxh-hr84","title":"devalue has prototype pollution in devalue.parse and devalue.unflatten","description":"In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.","status":"published","published":"2026-03-12T14:13:03Z","modified":"2026-03-12T14:13:04Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:39:35.644357Z"}],"nvd":[{"id":"CVE-2026-30226","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.","status":"published","published":"2026-03-11T18:16:22.937Z","modified":"2026-06-17T10:32:31.293Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:08.98071Z"}],"osv":[{"id":"CVE-2026-30226","title":"devalue has prototype pollution in devalue.parse and devalue.unflatten","description":"Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.","status":"published","published":"2026-03-11T17:47:40.016Z","modified":"2026-10-28T02:30:45.953894308Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-cfw5-2vxh-hr84","title":"devalue has prototype pollution in devalue.parse and devalue.unflatten","description":"In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.","status":"published","published":"2026-03-12T14:13:03Z","modified":"2026-03-14T02:41:21.965648Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:44.927642Z"},{"id":"CLSA-2026-1786357331","title":"TuxCare security update for devalue (5 CVEs)","description":"TuxCare rebuilt devalue to address 5 CVEs. Fixed in 4.3.2-tuxcare.1.","status":"published","published":"2026-08-10T10:22:11Z","modified":"2026-10-15T09:45:59.437400095Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"ROOT-APP-NPM-CVE-2026-30226","title":"CVE-2026-30226 in @rootio/devalue - Patched by Root","description":"Root has patched CVE-2026-30226 in the @rootio/devalue package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-07-08T10:52:37Z","modified":"2026-07-08T13:00:17.562134547Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}