CVE-2026-30226
High
Description
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
SeverityHigh
CVSS7.5
Exploit probability41. percentile0.5%
Product
Svelte Devalue
PublishedMar 11, 2026
First seenMar 11, 2026
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- svelte devalue5.6.4 or later
- devalue5.6.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| svelte devalue | v < 5.6.4 | 5.6.4 |
| devaluenpm | v < 5.6.4 | 5.6.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.