CVE-2026-30226mediumCWE-1321

CVE-2026-30226: fallo de gravedad media en sveltejs devalue

devalue has prototype pollution in devalue.parse and devalue.unflatten

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear devalue+ Monitorear devalue

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.5%
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Productos afectados
sveltejs · devalue
CVEs relacionadas — sveltejs devalue

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-92708HIGHdevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersEPSS 0.7%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%CVE-2026-42570HIGHSvelte devalue: DoS via sparse array deserializationEPSS 0.4%CVE-2026-123563HIGHDevalue before 5.9.3 Typed-Array Allocation Validation Bypass via parseEPSS 0.4%