Skip to main content
cve.nowby Sazabi
← npm
npmPackage

devalue

16 known vulnerabilities (8 high, 4 medium, 4 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
16 · 8 high, 4 medium, 4 low
Weekly downloads
24.5M
Dependents
414
Registry
npm

Advisories 16

  • Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

    Affected: from 5.8.0, fixed in 5.9.3.

  • devalue: Residual sparse-array CPU amplification in uneval

    Affected: fixed in 5.9.3.

  • devalue: Repeated primitive strings cause quadratic expansion in uneval

    Affected: fixed in 5.9.3.

  • devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

    Affected: from 1.0.0, fixed in 5.9.3.

  • devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

    Affected: fixed in 5.9.3.

  • devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

    Affected: fixed in 5.9.3.

  • devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

    Affected: from 5.1.0, fixed in 5.9.3.

  • CVE-2026-81176Medium 5.3

    Svelte devalue: DoS via malformed input

    Affected: fixed in 5.9.2.

  • Svelte devalue: DoS via sparse array deserialization

    Affected: from 5.6.3, fixed in 5.8.1.

  • Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

    Affected: from 4.0.0, fixed in 5.6.4.

  • CVE-2026-30226Medium 6.3

    devalue has prototype pollution in devalue.parse and devalue.unflatten

    Affected: fixed in 5.6.4.

  • devalue affected by CPU and memory amplification from sparse arrays

    Affected: fixed in 5.6.3.

  • devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

    Affected: fixed in 5.6.3.

  • devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

    Affected: from 5.1.0, fixed in 5.6.2.

  • devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

    Affected: from 5.3.0, fixed in 5.6.2.

  • Svelte devalue vulnerable to prototype pollution

    Affected: fixed in 5.3.2.