Executive brief
devalue is a JavaScript library used to serialize and deserialize complex data structures. The library contains a prototype pollution vulnerability in its parse and unflatten functions that can be exploited by sending maliciously crafted payloads, potentially causing application crashes or unexpected behavior through type confusion.
Technical details
The vulnerability is a prototype pollution flaw (CWE-1321) affecting devalue v5.6.3 in the parse() and unflatten() methods. An attacker can send specially crafted serialized payloads over the network to pollute the Object prototype, bypassing normal property restrictions. Successful exploitation can result in Denial of Service (DoS) through application crashes or type confusion vulnerabilities. The fix is available in version 5.6.4.
Affected products
- Svelte devalue 5.6.3 and earlier
Timeline
- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 5.6.4