CVE-2025-57820: devalue Package Prototype Pollution Vulnerability
Summary
CVE-2025-57820: devalue prototype pollution vulnerability. Affects devalue versions < 5.3.2. Fixed in 5.3.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The devalue package is a JavaScript library used for serializing and deserializing JavaScript objects. It allows developers to convert complex data structures into a string format and back again, making it easier to transmit data over networks or store it in databases. However, the package has a vulnerability that allows prototype pollution, which can lead to serious security issues if exploited.
Vulnerability Detail
The vulnerability in devalue arises from its parse method, which allows the setting of the proto property in objects. This can lead to an attacker being able to overwrite properties of existing objects, potentially compromising the integrity of the application. Additionally, the parse method does not validate array indices, allowing array prototype methods to be assigned to object properties, which can further facilitate exploitation. This vulnerability can be leveraged to bypass server-side validation, leading to unauthorized access or manipulation of data.
How To Fix
Latest published version: 6.0.3 as of 23 Oct 2026
npm install devalue@6.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.3.2
This is the first release that contains the fix.
npm install devalue@5.3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the devalue.parse method with untrusted input. Always validate and sanitize any data before processing it with this method to mitigate the risk of prototype pollution.
Conclusion
The devalue package has a significant vulnerability that allows for prototype pollution, which can lead to severe security risks. It is crucial to update to the patched version 5.3.2 or later to mitigate these risks. Additionally, employing input validation can serve as a temporary measure until the update is applied.
See every vulnerability recorded for devalue →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, potentially leading to the alteration of properties and methods of all instances of that object.
If exploited, this vulnerability can allow attackers to manipulate object properties, bypass security checks, and execute arbitrary code, leading to data breaches or application crashes.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your package-lock.json without any signup.
If an immediate update is not possible, implement input validation and sanitization to prevent untrusted data from being processed by the devalue.parse method.
More information can be found in the official advisory on GitHub and the CVE database, which provide detailed insights into the vulnerability and its implications.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
