npm/devalue CVE-2026-123567: low, EPSS 0.24%

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

Action: Upgrade devalue to 5.6.4 or later.

npm i devalue@5.6.4

Affected

Fixed versions

Sources

• osv: GHSA-mwv9-gp5h-frr4
• https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4
• https://github.com/sveltejs/devalue/commit/87c1f3ce3759765a061cfe34843ecc4b0711ba8d
• https://github.com/sveltejs/devalue
• https://github.com/sveltejs/devalue/releases/tag/v5.6.4

CVE-2026-123567 · published 2026-03-12T16:38:15Z · modified 2026-11-08T10:56:14.491676861Z · JSON