Security advisories

high2026-10-01

devalue: `stringify`/`uneval` serialize shared memory

GHSA-j22f-vq7h-c4qm · CVE-2026-92708

medium2026-10-01

devalue: Residual sparse-array CPU amplification in uneval

GHSA-hx4r-w6wj-j8fg

high2026-10-01

devalue: Repeated primitive strings cause quadratic expansion in uneval

GHSA-mcm9-63f2-9j32

low2026-10-01

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

GHSA-wf3x-273g-mvxv

high2026-10-01

devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

GHSA-r9w8-h9r3-54w4

high2026-10-01

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

GHSA-x5rw-q4pp-hg5g

medium2026-10-01

devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion

GHSA-4q55-j62x-fr9h

medium2026-09-17

Svelte devalue: DoS via malformed input

GHSA-9rgm-9g3h-6x36 · CVE-2026-81176

high2026-05-14

Svelte devalue: DoS via sparse array deserialization

GHSA-77vg-94rm-hx3p · CVE-2026-42570

low2026-03-12

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

GHSA-mwv9-gp5h-frr4

medium2026-03-12

devalue has prototype pollution in devalue.parse and devalue.unflatten

GHSA-cfw5-2vxh-hr84 · CVE-2026-30226

low2026-02-19

devalue affected by CPU and memory amplification from sparse arrays

GHSA-33hq-fvwr-56pm

low2026-02-19

devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

GHSA-8qm3-746x-r74r

high2026-01-15

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

GHSA-g2pg-6438-jwpf · CVE-2026-22775

high2026-01-15

Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

GHSA-vw5p-8cq8-m7mv · CVE-2026-22774

high2025-08-26

devalue prototype pollution vulnerability

GHSA-vj54-72f3-p5jv · CVE-2025-57820