devalue (npm)
Gets the job done when JSON.stringify can't
Advisories
32
Latest version
6.0.3
Released Oct 13, 2026
License
MIT
OpenSSF Scorecard
—
How to fix
Upgrading to 5.9.3 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install devalue@6.0.3yarn
yarn add devalue@6.0.3pnpm
pnpm add devalue@6.0.3Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-hx4r-w6wj-j8fg devalue: Residual sparse-array CPU amplification in uneval |
Medium | <= 5.9.2 | No fix yet |
| GHSA-hx4r-w6wj-j8fg devalue: Residual sparse-array CPU amplification in uneval |
Medium | < 5.9.3 | 5.9.3 |
| GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval |
High | < 5.9.3 | 5.9.3 |
| GHSA-mcm9-63f2-9j32 devalue: Repeated primitive strings cause quadratic expansion in uneval |
High | <= 5.9.2 | No fix yet |
| GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated |
Low | >= 1.0.0, < 5.9.3 | 5.9.3 |
| GHSA-wf3x-273g-mvxv devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated |
Low | >= 1.0.0, <= 5.9.2 | No fix yet |
| GHSA-r9w8-h9r3-54w4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation |
High | < 5.9.3 | 5.9.3 |
| GHSA-r9w8-h9r3-54w4 devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation |
High | <= 5.9.2 | No fix yet |
| GHSA-x5rw-q4pp-hg5g devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise |
High | >= 5.8.0, <= 5.9.2 | No fix yet |
| GHSA-x5rw-q4pp-hg5g devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise |
High | >= 5.8.0, < 5.9.3 | 5.9.3 |
| GHSA-4q55-j62x-fr9h devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion |
Medium | <= 5.9.2 | No fix yet |
| GHSA-4q55-j62x-fr9h devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion |
Medium | < 5.9.3 | 5.9.3 |
| GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory |
High EPSS 0.73% |
>= 5.1.0, <= 5.9.2 | No fix yet |
| GHSA-j22f-vq7h-c4qm devalue: `stringify`/`uneval` serialize shared memory |
High EPSS 0.73% |
>= 5.1.0, < 5.9.3 | 5.9.3 |
| GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input |
Medium EPSS 0.51% |
< 5.9.2 | 5.9.2 |
| GHSA-9rgm-9g3h-6x36 Svelte devalue: DoS via malformed input |
Medium EPSS 0.51% |
< 5.9.1 | 5.9.1 |
| GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization |
High EPSS 0.40% |
>= 5.6.3, <= 5.8.0 | No fix yet |
| GHSA-77vg-94rm-hx3p Svelte devalue: DoS via sparse array deserialization |
High EPSS 0.40% |
>= 5.6.3, < 5.8.1 | 5.8.1 |
| GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties |
Low | >= 4.0.0, < 5.6.4 | 5.6.4 |
| GHSA-mwv9-gp5h-frr4 Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties |
Low | >= 4.0.0, < 5.6.4 | 5.6.4 |
| GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten |
Medium EPSS 0.42% |
< 5.6.4 | 5.6.4 |
| GHSA-cfw5-2vxh-hr84 devalue has prototype pollution in devalue.parse and devalue.unflatten |
Medium EPSS 0.42% |
< 5.6.4 | 5.6.4 |
| GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays |
Low | <= 5.6.2 | No fix yet |
| GHSA-33hq-fvwr-56pm devalue affected by CPU and memory amplification from sparse arrays |
Low | < 5.6.3 | 5.6.3 |
| GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed |
Low | < 5.6.3 | 5.6.3 |
| GHSA-8qm3-746x-r74r devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed |
Low | <= 5.6.2 | No fix yet |
| GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse |
High EPSS 0.62% |
>= 5.1.0, < 5.6.2 | 5.6.2 |
| GHSA-g2pg-6438-jwpf devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse |
High EPSS 0.62% |
>= 5.1.0, < 5.6.2 | 5.6.2 |
| GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse |
High EPSS 0.62% |
>= 5.3.0, <= 5.6.1 | No fix yet |
| GHSA-vw5p-8cq8-m7mv Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse |
High EPSS 0.62% |
>= 5.3.0, < 5.6.2 | 5.6.2 |
| GHSA-vj54-72f3-p5jv devalue prototype pollution vulnerability |
High EPSS 0.37% |
< 5.3.2 | 5.3.2 |
| GHSA-vj54-72f3-p5jv devalue prototype pollution vulnerability |
High EPSS 0.37% |
< 5.3.2 | 5.3.2 |
Source: git+https://github.com/sveltejs/devalue.git
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor