Executive brief
Sveltejs devalue is a library used to serialize and deserialize JavaScript objects. The library's parse and unflatten functions can emit objects with `__proto__` properties, which can lead to prototype pollution when downstream code uses these objects unsafely (e.g., with Object.assign). While not a direct vulnerability in devalue itself, this behavior enables prototype pollution attacks if the deserialized data is mishandled by applications.
Technical details
The vulnerability is a prototype pollution weakness (CWE-1321) in the devalue library's `parse` and `unflatten` functions. Under certain circumstances, these functions emit objects containing `__proto__` as an own property. Although JSON.parse exhibits the same behavior and `__proto__` own properties are not inherently dangerous, they become exploitable when downstream code incorrectly processes the deserialized objects—specifically when using Object.assign or similar patterns that can pollute the prototype chain. The vulnerability affects versions 4.0.0 through 5.6.3 and has been patched in version 5.6.4 with changes to disallow `__proto__` keys.
Affected products
- Sveltejs devalue 4.0.0 to 5.6.3
Timeline
- 2026-03-12: disclosed
- 2026-03-12: patched: Fixed in version 5.6.4