GHSA-4q55-j62x-fr9h

devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

Medium npm

Severity: 6.3 / 10; Medium · CVSS 4.0
Exploit chance (EPSS): —; No score published
Known exploited: No; Not in CISA's catalog
Weakness: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Fix: 5.9.3; Upgrade devalue to this version or later

Description

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to be a little more defensive here and not allow the creation of objects with __proto__ own-properties. It is very unlikely for this to cause any issues.

Affected versions

npm

Package	Vulnerable	Fixed in
devalue	`<= 5.9.2`	No fix yet
devalue	`< 5.9.3`	`5.9.3`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

devalue npm → `5.9.3`

npm

npm install devalue@5.9.3

yarn

yarn add devalue@5.9.3

pnpm

pnpm add devalue@5.9.3

Severity breakdown

CVSS 4.0 6.3

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N

Attack vector: Network
Attack complexity: High
Attack requirements: Present
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): None
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): Low
Availability (subsequent systems): None

Weakness

CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

How to prevent it

Implementation: By freezing the object prototype first (for example, Object.freeze(Object.prototype)), modification of the prototype becomes impossible.
Architecture and Design: By blocking modifications of attributes that resolve to object prototype, such as proto or prototype, this weakness can be mitigated.
Implementation: When handling untrusted objects, validating using a schema can be used.
Implementation: By using an object without prototypes (via Object.create(null) ), adding object prototype attributes by accessing the prototype via the special attributes becomes impossible, mitigating this weakness.
Implementation: Map can be used instead of objects in most cases. If Map methods are used instead of object attributes, it is not possible to access the object prototype or modify it.

References

Advisories

Fixes and patches

github.com/sveltejs/devalue/commit/9ec513072e31f45e60d44dad6f0dba9c92bb8675

Packages

github.com/sveltejs/devalue

Timeline

Oct 1, 2026 Published
Oct 1, 2026 Last updated by the source

Advisory	Severity	Why it's related
GHSA-hx4r-w6wj-j8fg devalue: Residual sparse-array CPU amplification in uneval	Medium	Also affects devalue
GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval	High	Also affects devalue
GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated	Low	Also affects devalue
GHSA-r9w8-h9r3-54w4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation	High	Also affects devalue
GHSA-x5rw-q4pp-hg5g devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise	High	Also affects devalue
GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory	High	Also affects devalue
GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input	Medium	Also affects devalue
GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization	High	Also affects devalue

Credits: elliott-with-the-longest-name-on-github

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor