# devalue (npm) vulnerabilities

16 known vulnerabilities (8 high, 4 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Weekly downloads: 24.5M
- Dependents: 414
- Registry: https://www.npmjs.com/package/devalue

## Advisories (16)

### [CVE-2026-123562](https://cve.now/CVE-2026-123562): Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection

- Severity: High 8.7
- Published: Nov 8, 2026
- Affected: from 5.8.0, fixed in 5.9.3.

### [GHSA-HX4R-W6WJ-J8FG](https://cve.now/GHSA-HX4R-W6WJ-J8FG): devalue: Residual sparse-array CPU amplification in uneval

- Severity: Medium
- Published: Oct 1, 2026
- Affected: fixed in 5.9.3.

### [GHSA-MCM9-63F2-9J32](https://cve.now/GHSA-MCM9-63F2-9J32): devalue: Repeated primitive strings cause quadratic expansion in uneval

- Severity: High
- Published: Oct 1, 2026
- Affected: fixed in 5.9.3.

### [GHSA-WF3X-273G-MVXV](https://cve.now/GHSA-WF3X-273G-MVXV): devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

- Severity: Low
- Published: Oct 1, 2026
- Affected: from 1.0.0, fixed in 5.9.3.

### [GHSA-R9W8-H9R3-54W4](https://cve.now/GHSA-R9W8-H9R3-54W4): devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation

- Severity: High
- Published: Oct 1, 2026
- Affected: fixed in 5.9.3.

### [GHSA-4Q55-J62X-FR9H](https://cve.now/GHSA-4Q55-J62X-FR9H): devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

- Severity: Medium
- Published: Oct 1, 2026
- Affected: fixed in 5.9.3.

### [CVE-2026-92708](https://cve.now/CVE-2026-92708): devalue: Cross-request process memory disclosure in devalue when \`stringify\` / \`uneval\` serialize Node Buffers

- Severity: High 7.5
- Published: Sep 18, 2026
- Affected: from 5.1.0, fixed in 5.9.3.

### [CVE-2026-81176](https://cve.now/CVE-2026-81176): Svelte devalue: DoS via malformed input

- Severity: Medium 5.3
- Published: Sep 16, 2026
- Affected: fixed in 5.9.2.

### [CVE-2026-42570](https://cve.now/CVE-2026-42570): Svelte devalue: DoS via sparse array deserialization

- Severity: High 7.5
- Published: Jun 9, 2026
- Affected: from 5.6.3, fixed in 5.8.1.

### [GHSA-MWV9-GP5H-FRR4](https://cve.now/GHSA-MWV9-GP5H-FRR4): Sveltejs devalue's \`devalue.parse\` and \`devalue.unflatten\` emit objects with \`proto\` own properties

- Severity: Low
- Published: Mar 12, 2026
- Affected: from 4.0.0, fixed in 5.6.4.

### [CVE-2026-30226](https://cve.now/CVE-2026-30226): devalue has prototype pollution in devalue.parse and devalue.unflatten

- Severity: Medium 6.3
- Published: Mar 11, 2026
- Affected: fixed in 5.6.4.

### [GHSA-33HQ-FVWR-56PM](https://cve.now/GHSA-33HQ-FVWR-56PM): devalue affected by CPU and memory amplification from sparse arrays

- Severity: Low
- Published: Feb 19, 2026
- Affected: fixed in 5.6.3.

### [GHSA-8QM3-746X-R74R](https://cve.now/GHSA-8QM3-746X-R74R): devalue \`uneval\`ed code can create objects with polluted prototypes when \`eval\`ed

- Severity: Low
- Published: Feb 19, 2026
- Affected: fixed in 5.6.3.

### [CVE-2026-22775](https://cve.now/CVE-2026-22775): devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

- Severity: High 7.5
- Published: Jan 15, 2026
- Affected: from 5.1.0, fixed in 5.6.2.

### [CVE-2026-22774](https://cve.now/CVE-2026-22774): devalue vulnerable to denial of service due to memory exhaustion in devalue.parse

- Severity: High 7.5
- Published: Jan 15, 2026
- Affected: from 5.3.0, fixed in 5.6.2.

### [CVE-2025-57820](https://cve.now/CVE-2025-57820): Svelte devalue vulnerable to prototype pollution

- Severity: High 7.9
- Published: Aug 26, 2025
- Affected: fixed in 5.3.2.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/npm/devalue
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.