CVE-2026-30226mediumCWE-1321

CVE-2026-30226: falha de média gravidade em sveltejs devalue

devalue has prototype pollution in devalue.parse and devalue.unflatten

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar devalue+ Monitorar devalue

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.5%
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Produtos afetados
sveltejs · devalue
CVEs relacionadas — sveltejs devalue

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92708HIGHdevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersEPSS 0.7%CVE-2026-22775HIGHdevalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parseEPSS 0.6%CVE-2026-22774HIGHdevalue vulnerable to denial of service due to memory exhaustion in devalue.parseEPSS 0.6%CVE-2026-81176MEDIUMSvelte devalue: DoS via malformed inputEPSS 0.5%CVE-2026-42570HIGHSvelte devalue: DoS via sparse array deserializationEPSS 0.4%CVE-2026-123563HIGHDevalue before 5.9.3 Typed-Array Allocation Validation Bypass via parseEPSS 0.4%