High severity · published Mar 11, 2026
CVE-2026-30226
devalue has prototype pollution in devalue.parse and devalue.unflatten
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DE
devalue · sveltejs
< 5.6.4 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-30226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-30226
Vendor Advisory
https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84
More from devalue
7.5
CVE-2026-92708
devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers
7.5
CVE-2026-42570
Svelte devalue: DoS via sparse array deserialization
7.5
CVE-2026-22775
devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse
7.5
CVE-2026-22774
devalue vulnerable to denial of service due to memory exhaustion in devalue.parse
5.3
CVE-2026-81176
Svelte devalue: DoS via malformed input