CVE-2026-30226: 
JavaScript vulnerability analysis and mitigation

CVE-2026-30226 is a prototype pollution vulnerability in the Svelte devalue JavaScript library, affecting the devalue.parse and devalue.unflatten functions. The library is used to serialize JavaScript values into strings when JSON.stringify is insufficient. All versions up to and including v5.6.3 (for Node.js) are affected; the issue was disclosed and patched on March 11, 2026 with the release of v5.6.4. It carries a CVSS v3.1 score of 7.5 (High) and a CVSS v4.0 score of 6.3 (Medium) (Github Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes — Prototype Pollution) and secondarily CWE-843 (Type Confusion). The devalue.parse and devalue.unflatten functions fail to properly sanitize or restrict keys in deserialized payloads, allowing an attacker to inject properties such as __proto__ or constructor into the JavaScript object prototype chain. No authentication or user interaction is required; an attacker only needs to supply a maliciously crafted serialized payload to an endpoint that passes it to one of the vulnerable functions. The vulnerability was reported by elliott-with-the-longest-name-on-github and remediated by KarimPwnz, with review by jviide (GitHub Security Advisory).

Successful exploitation can result in Denial of Service (DoS) by corrupting shared JavaScript object prototypes, causing application crashes or unexpected behavior, or in type confusion that may affect downstream application logic. Because prototype pollution modifies globally shared objects, the impact can propagate across the entire Node.js process, potentially affecting all objects in the application. Confidentiality and integrity impacts are assessed as none at the vulnerable system level, but type confusion could have unpredictable downstream effects depending on how the application uses deserialized data (Github Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure (Github Advisory). The EPSS score is approximately 0.043–0.143%, placing it in the 34th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Identify target: Locate a Node.js application using devalue v5.6.3 or earlier that exposes an endpoint accepting serialized data processed by devalue.parse or devalue.unflatten.
2. Craft malicious payload: Construct a serialized devalue payload that includes a key targeting the object prototype, such as a reference to __proto__ or constructor.prototype, designed to inject arbitrary properties into the prototype chain.
3. Submit payload: Send the crafted payload to the vulnerable endpoint via an HTTP request or any other input channel that feeds data into devalue.parse or devalue.unflatten.
4. Trigger prototype pollution: The vulnerable function processes the payload without sanitizing prototype-modifying keys, causing the injected properties to be set on Object.prototype, affecting all objects in the running Node.js process.
5. Achieve DoS or type confusion: Depending on the injected properties, the application may crash (DoS) or exhibit unexpected type-related behavior, potentially disrupting service or causing logic errors in downstream processing (GitHub Security Advisory).

The vulnerability is fixed in devalue version 5.6.4. All users running devalue v5.6.3 or earlier should upgrade immediately by running npm install devalue@5.6.4 or updating their package.json dependency. No configuration-based workaround is available; upgrading is the only recommended remediation. Organizations should audit their dependency trees (including transitive dependencies) to identify all uses of the affected package (GitHub Security Advisory, Red Hat Bugzilla).

The remediation reviewer jviide noted the fix on Mastodon/infosec.exchange shortly after disclosure. The vulnerability received routine coverage in automated CVE tracking feeds and security aggregators. No major vendor statements or significant media coverage beyond standard advisory publication have been observed (Github Advisory).