Devalue
16 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Devalue, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Devalue CVEs per month
| Month | CVEs |
|---|---|
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 1 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 2 |
| 2026-02 | 2 |
| 2026-03 | 2 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 1 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 2 |
| 2026-10 | 6 |
Severity
How the 16 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High5
- Medium1
Latest CVEs
The 15 most recently published vulnerabilities affecting Devalue.
- GHSA-hx4r-w6wj-j8fgdevalue: Residual sparse-array CPU amplification in uneval—
- GHSA-mcm9-63f2-9j32devalue: Repeated primitive strings cause quadratic expansion in uneval—
- GHSA-wf3x-273g-mvxvdevalue: Sparse arrays emitted by uneval cause eager allocation when evaluated—
- GHSA-r9w8-h9r3-54w4devalue: Custom ArrayBuffer revivers can bypass typed-array allocation validation—
- GHSA-x5rw-q4pp-hg5gdevalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise—
- GHSA-4q55-j62x-fr9hdevalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion—
- CVE-2026-92708devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers7.5
- CVE-2026-81176Svelte devalue: DoS via malformed input5.3
- CVE-2026-42570Svelte devalue: DoS via sparse array deserialization7.5
- GHSA-mwv9-gp5h-frr4Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties—
- CVE-2026-30226devalue has prototype pollution in devalue.parse and devalue.unflatten7.5
- GHSA-33hq-fvwr-56pmdevalue affected by CPU and memory amplification from sparse arrays—
- GHSA-8qm3-746x-r74rdevalue `uneval`ed code can create objects with polluted prototypes when `eval`ed—
- CVE-2026-22775devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse7.5
- CVE-2026-22774devalue vulnerable to denial of service due to memory exhaustion in devalue.parse7.5
Product grouping is registry-driven, with AI assist and human review. How it works