# CVE-2025-57820: devalue prototype pollution in parse()

Source: https://junglewise.ai/threats/cve-2025-57820-devalue-prototype-pollution-in-parse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-08-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-57820 · Severity: medium · CVSS 4 · Published 2025-08-26

devalue is a JavaScript library used to serialize and deserialize complex data structures. A prototype pollution vulnerability in the parse() function allows an attacker to inject malicious properties into object prototypes or assign array methods to object properties, potentially bypassing validation logic or corrupting application state.

Technologies: [devalue (npm)](https://junglewise.ai/threats/technologies/devalue). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2025-57820 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-57820 being exploited in the wild.

**How severe is CVE-2025-57820?** Medium severity, with a CVSS score of 4, published 26 August 2025.

**Which products and versions are affected?** devalue (npm) SEMVER:introduced=0,fixed=5.3.2.

**Is there a fix for CVE-2025-57820?** Yes. devalue (npm): upgrade to 5.3.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-57820 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-57820?** Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devalue (npm): upgrade to 5.3.2 or later

  ```sh
  npm install devalue@5.3.2
  ```


## Technical details

The vulnerability exists in devalue.parse() which fails to properly sanitize input when deserializing strings. Two attack vectors are present: (1) allowing __proto__ to be set on deserialized objects, enabling prototype pollution that can overwrite inherited properties and methods, and (2) allowing non-numeric indices in the payload to assign array prototype methods to arbitrary object properties. Both require only network access and no authentication. An attacker can craft a malicious payload to manipulate object behavior at runtime or bypass server-side validation checks. The vulnerability affects all versions prior to 5.3.2.

## Affected products

- Svelte devalue < 5.3.2

## Identifiers

- CVE-2025-57820
- GHSA-vj54-72f3-p5jv

## Timeline

- 2025-08-26: disclosed
- 2025-08-26: patched: version 5.3.2

## References

- [https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv](https://github.com/sveltejs/devalue/security/advisories/GHSA-vj54-72f3-p5jv)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)