CVE-2026-30226 devalue has prototype pollution in devalue.parse and devalue.unflatten

What is CVE-2026-30226?

CVE-2026-30226 is a medium-severity vulnerability in sveltejs devalue, published on 11 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.

Weakness: CWE-1321

Which versions are affected by CVE-2026-30226?

2 open source packages ship an affected version, including devalue. It affects 1 product.

Products include Svelte Devalue.

How do I fix CVE-2026-30226?

Upgrade devalue to 5.6.4 or later.

Is CVE-2026-30226 being exploited?

There is no known exploitation of CVE-2026-30226 in the wild and no public exploit code.

Other vulnerabilities in sveltejs devalue

• CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization High 7.5
• CVE-2026-22774 devalue vulnerable to denial of service due to memory exhaustion in devalue.parse High 7.5
• CVE-2026-22775 devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-cfw5-2vxh-hr84, ROOT-APP-NPM-CVE-2026-30226.