GHSA-4q55-j62x-fr9h

devalue: Malformed null-prototype object keys bypass proto rejection via property-key coercion

Risk score: 43/100
CVSS: 6.3 v4.0
Published: 1 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause parse to create objects with a __proto__ own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how JSON.parse works, but we decided to…
Affected: devalue (npm) <= 5.9.2
Fix: Upgrade devalue to 5.9.3 or later.
Exploitation: No known exploitation

Why it is Yellow

CVSS 6.3 medium
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
devalue	npm	<= 5.9.2	5.9.3

References

Original description

This is another instance of https://github.com/sveltejs/devalue/security/advisories/GHSA-mwv9-gp5h-frr4, where some payloads could cause `parse` to create objects with a `__proto__` own property. This on its own is not enough to cause prototype pollution, and indeed this is actually how `JSON.parse` works, but we decided to be a little more defensive here and not allow the creation of objects with `__proto__` own-properties. It is very unlikely for this to cause any issues.