CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 01/10/2026 |
| GHSA-4q55-j62x-fr9h | 中危 | devalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion | 01/10/2026 |
| CVE-2026-92708 | 高危7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose b | 18/09/2026 |
| CVE-2026-81176 | 中危5.3 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alte | 16/09/2026 |
| CVE-2026-42570 | 高危7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arra | 09/06/2026 |
| GHSA-mwv9-gp5h-frr4 | 低危 | Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties | 12/03/2026 |
| CVE-2026-30226 | 高危7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Servic | 11/03/2026 |
| GHSA-33hq-fvwr-56pm | 低危 | devalue affected by CPU and memory amplification from sparse arrays | 19/02/2026 |
| GHSA-8qm3-746x-r74r | 低危 | devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed | 19/02/2026 |
| CVE-2026-22775 | 高危7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted source | 15/01/2026 |
| CVE-2026-22774 | 高危7.5 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain inputs can cause devalue.parse to consume excessive CPU time and/or memory, potentially leading to denial of service in systems that parse input from untrusted source | 15/01/2026 |
| CVE-2025-57820 | 高危7.9 | Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.parse does not check that an index is numeric. This could result in assigning prototypes to objects and properties, leading to prototype pollution. This issue has | 26/08/2025 |