# CVE-2026-30226: devalue prototype pollution in parse and unflatten

Source: https://junglewise.ai/threats/cve-2026-30226-devalue-prototype-pollution-in-parse-and-unflatten  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-30226 · Severity: medium · CVSS 4 · Published 2026-03-12

devalue is a JavaScript library used to serialize and deserialize complex data structures. The library contains a prototype pollution vulnerability in its parse and unflatten functions that can be exploited by sending maliciously crafted payloads, potentially causing application crashes or unexpected behavior through type confusion.

Technologies: [devalue (npm)](https://junglewise.ai/threats/technologies/devalue). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-30226 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-30226 being exploited in the wild.

**How severe is CVE-2026-30226?** Medium severity, with a CVSS score of 4, published 12 March 2026.

**Which products and versions are affected?** devalue (npm) SEMVER:introduced=0,fixed=5.6.4.

**Is there a fix for CVE-2026-30226?** Yes. devalue (npm): upgrade to 5.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-30226 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-30226?** Check whether you run devalue (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- devalue (npm): upgrade to 5.6.4 or later

  ```sh
  npm install devalue@5.6.4
  ```


## Technical details

The vulnerability is a prototype pollution flaw (CWE-1321) affecting devalue v5.6.3 in the parse() and unflatten() methods. An attacker can send specially crafted serialized payloads over the network to pollute the Object prototype, bypassing normal property restrictions. Successful exploitation can result in Denial of Service (DoS) through application crashes or type confusion vulnerabilities. The fix is available in version 5.6.4.

## Affected products

- Svelte devalue 5.6.3 and earlier

## Identifiers

- CVE-2026-30226
- GHSA-cfw5-2vxh-hr84

## Timeline

- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 5.6.4

## References

- [https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84](https://github.com/sveltejs/devalue/security/advisories/GHSA-cfw5-2vxh-hr84)

## Related threats

- [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c)
- [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e)
- [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840)
- [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f)
- [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8)