# devalue (npm) vulnerabilities Source: https://junglewise.ai/threats/technologies/devalue Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/devalue.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in devalue (npm): 0 in the last 7 days and 8 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, devalue uneval sparse-array CPU amplification, was published on 1 October 2026. Nothing in the last four weeks, down from 8 vulnerabilities in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 8 - All time: 16 (0 critical, 0 exploited in the wild) ## About devalue (npm) JavaScript library for serializing values into JSON-compatible representations. ## Latest devalue (npm) vulnerabilities - [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c) (medium, CVSS 4, published 1 Oct 2026) - [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e) (medium, CVSS 4, published 1 Oct 2026) - [devalue sparse arrays excessive memory allocation in uneval](https://junglewise.ai/threats/devalue-sparse-arrays-emitted-by-uneval-cause-eager-allocation-when-79528840) (medium, CVSS 4, published 1 Oct 2026) - [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f) (high, CVSS 4, published 1 Oct 2026) - [devalue stringifyAsync unhandled promise rejection](https://junglewise.ai/threats/devalue-stringifyasync-can-cause-an-unhandled-rejection-despite-a-1b814ff8) (medium, CVSS 4, published 1 Oct 2026) - [devalue library __proto__ bypass via malformed null-prototype keys](https://junglewise.ai/threats/devalue-malformed-null-prototype-object-keys-bypass-proto-rejection-via-aefa93ff) (medium, CVSS 4, published 1 Oct 2026) - [CVE-2026-92708: Svelte devalue memory disclosure in Node Buffer serialization](https://junglewise.ai/threats/cve-2026-92708-svelte-devalue-is-a-javascript-library-that-serializes-values) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-81176: Svelte devalue DoS via malformed input](https://junglewise.ai/threats/cve-2026-81176-svelte-devalue-dos-via-malformed-input) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-42570: Svelte devalue denial of service in devalue.parse](https://junglewise.ai/threats/cve-2026-42570-svelte-devalue-denial-of-service-in-devalue-parse) (high, CVSS 7.5, published 9 Jun 2026) - [Sveltejs devalue prototype pollution in parse and unflatten](https://junglewise.ai/threats/sveltejs-devalue-prototype-pollution-in-parse-and-unflatten-d6289af5) (medium, CVSS 4, published 12 Mar 2026) - [CVE-2026-30226: devalue prototype pollution in parse and unflatten](https://junglewise.ai/threats/cve-2026-30226-devalue-prototype-pollution-in-parse-and-unflatten) (medium, CVSS 4, published 12 Mar 2026) - [Svelte devalue CPU and memory exhaustion in sparse arrays](https://junglewise.ai/threats/svelte-devalue-dos-via-sparse-array-serialization-3093799b) (medium, CVSS 4, published 19 Feb 2026) - [Svelte devalue prototype pollution via uneval](https://junglewise.ai/threats/svelte-devalue-prototype-pollution-via-uneval-14b7c8df) (medium, CVSS 4, published 19 Feb 2026) - [CVE-2026-22775: Svelte devalue denial of service via resource exhaustion in parse](https://junglewise.ai/threats/cve-2026-22775-svelte-devalue-denial-of-service-via-resource-exhaustion-in-parse) (high, CVSS 7.5, published 15 Jan 2026) - [CVE-2026-22774: Svelte devalue denial of service in devalue.parse](https://junglewise.ai/threats/cve-2026-22774-svelte-devalue-denial-of-service-in-devalue-parse) (high, CVSS 7.5, published 15 Jan 2026) - [CVE-2025-57820: devalue prototype pollution in parse()](https://junglewise.ai/threats/cve-2025-57820-devalue-prototype-pollution-in-parse) (medium, CVSS 4, published 26 Aug 2025) ## Most severe devalue (npm) vulnerabilities - [CVE-2026-92708: Svelte devalue memory disclosure in Node Buffer serialization](https://junglewise.ai/threats/cve-2026-92708-svelte-devalue-is-a-javascript-library-that-serializes-values) (high, CVSS 7.5, published 18 Sep 2026) - [CVE-2026-42570: Svelte devalue denial of service in devalue.parse](https://junglewise.ai/threats/cve-2026-42570-svelte-devalue-denial-of-service-in-devalue-parse) (high, CVSS 7.5, published 9 Jun 2026) - [CVE-2026-22775: Svelte devalue denial of service via resource exhaustion in parse](https://junglewise.ai/threats/cve-2026-22775-svelte-devalue-denial-of-service-via-resource-exhaustion-in-parse) (high, CVSS 7.5, published 15 Jan 2026) - [CVE-2026-22774: Svelte devalue denial of service in devalue.parse](https://junglewise.ai/threats/cve-2026-22774-svelte-devalue-denial-of-service-in-devalue-parse) (high, CVSS 7.5, published 15 Jan 2026) - [devalue ArrayBuffer allocation bypass via custom reviver](https://junglewise.ai/threats/devalue-custom-arraybuffer-revivers-can-bypass-typed-array-allocation-ecd9322f) (high, CVSS 4, published 1 Oct 2026) - [CVE-2026-81176: Svelte devalue DoS via malformed input](https://junglewise.ai/threats/cve-2026-81176-svelte-devalue-dos-via-malformed-input) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-30226: devalue prototype pollution in parse and unflatten](https://junglewise.ai/threats/cve-2026-30226-devalue-prototype-pollution-in-parse-and-unflatten) (medium, CVSS 4, published 12 Mar 2026) - [CVE-2025-57820: devalue prototype pollution in parse()](https://junglewise.ai/threats/cve-2025-57820-devalue-prototype-pollution-in-parse) (medium, CVSS 4, published 26 Aug 2025) - [devalue uneval sparse-array CPU amplification](https://junglewise.ai/threats/devalue-residual-sparse-array-cpu-amplification-in-uneval-288a909c) (medium, CVSS 4, published 1 Oct 2026) - [devalue quadratic expansion in uneval with repeated primitives](https://junglewise.ai/threats/devalue-repeated-primitive-strings-cause-quadratic-expansion-in-uneval-9363872e) (medium, CVSS 4, published 1 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 8 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 6 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other npm technologies - [openclaw (npm)](https://junglewise.ai/threats/technologies/npm-openclaw): 214 vulnerabilities - [flowise (npm)](https://junglewise.ai/threats/technologies/flowise): 133 vulnerabilities - [parse-server (npm)](https://junglewise.ai/threats/technologies/parse-server): 117 vulnerabilities - [vm2 (npm)](https://junglewise.ai/threats/technologies/vm2): 111 vulnerabilities - [electron (npm)](https://junglewise.ai/threats/technologies/electron): 77 vulnerabilities - [ghost (npm)](https://junglewise.ai/threats/technologies/ghost): 74 vulnerabilities - [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n): 64 vulnerabilities - [hono (npm)](https://junglewise.ai/threats/technologies/hono): 62 vulnerabilities - [directus (npm)](https://junglewise.ai/threats/technologies/directus): 61 vulnerabilities - [nocodb (npm)](https://junglewise.ai/threats/technologies/nocodb): 54 vulnerabilities - [undici (npm)](https://junglewise.ai/threats/technologies/undici): 53 vulnerabilities - [@budibase/server (npm)](https://junglewise.ai/threats/technologies/budibase-server): 42 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "devalue (npm) vulnerabilities", https://junglewise.ai/threats/technologies/devalue, 13 November 2026.