CVE-2025-57820: high-severity vulnerability in sveltejs devalue
Svelte devalue vulnerable to prototype pollution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.9epss 0.4%
Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has been fixed in version 5.3.2
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Affected products
sveltejs · devalueRelated CVEs — sveltejs devalue
In the same product, most dangerous first.
CVE-2026-92708HIGHdevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersEPSS 0.7%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%CVE-2026-30226MEDIUMdevalue has prototype pollution in devalue.parse and devalue.unflattenEPSS 0.5%CVE-2026-42570HIGHSvelte devalue: DoS via sparse array deserializationEPSS 0.4%