CVE-2026-30226: devalue Prototype Pollution Vulnerability in devalue Package
Summary
CVE-2026-30226: devalue has prototype pollution in devalue.parse and devalue.unflatten. Affects devalue versions < 5.6.4. Fixed in 5.6.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The devalue package is a JavaScript library used for parsing and unflattening data structures. It is commonly utilized in Node.js applications to handle complex data manipulations. However, versions prior to 5.6.4 are susceptible to a serious security flaw that allows for prototype pollution, which can compromise the integrity of the application.
Vulnerability Detail
In devalue version 5.6.3, both the devalue.parse and devalue.unflatten functions are vulnerable to prototype pollution through specially crafted payloads. This vulnerability can lead to Denial of Service (DoS) attacks or type confusion, potentially allowing attackers to manipulate the prototype of built-in objects, which can disrupt application functionality and lead to further exploits.
How To Fix
Latest published version: 6.0.3 as of 23 Oct 2026
npm install devalue@6.0.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
5.6.4
This is the first release that contains the fix.
npm install devalue@5.6.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not feasible, consider validating and sanitizing all input data before passing it to the devalue functions to mitigate the risk of prototype pollution.
Conclusion
The devalue package has a critical vulnerability that allows for prototype pollution, which can lead to severe consequences for applications using it. It is essential to update to the latest version to mitigate risks and ensure application security.
See every vulnerability recorded for devalue →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of a base object, which can lead to unexpected behavior in applications.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to Denial of Service (DoS) or type confusion, which can disrupt application functionality and expose sensitive data.
Yes, the vulnerability has been patched in version 5.6.4 of the devalue package. It is recommended to update to this version or later.
The CVSS score for this vulnerability is 6.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for devalue.
