~ / search / GHSA-cfw5-2vxh-hr84

GHSA-cfw5-2vxh-hr84

devalue has prototype pollution in devalue.parse and devalue.unflatten

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-30226

Packages

EcosystemPackageAffectedFixed in
npm devalue < 5.6.4 5.6.4

Details

As written in the advisory (Markdown source, shown as plain text).

In devalue v5.6.3, `devalue.parse` and `devalue.unflatten` were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.

References

External links from the advisory. They lead to third-party sites.