GHSA-cfw5-2vxh-hr84

Source

https://github.com/advisories/GHSA-cfw5-2vxh-hr84

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cfw5-2vxh-hr84/GHSA-cfw5-2vxh-hr84.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-cfw5-2vxh-hr84

Aliases

CVE-2026-30226

Published

2026-03-12T14:13:03Z

Modified

2026-03-14T02:39:33.159638Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator

Summary

devalue has prototype pollution in devalue.parse and devalue.unflatten

Details

In devalue v5.6.3, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-1321"
    ],
    "github_reviewed_at": "2026-03-12T14:13:03Z",
    "nvd_published_at": "2026-03-11T18:16:22Z"
}

References

Affected packages

npm / devalue

Package

Name: devalue; View open source insights on deps.dev
Purl: pkg:npm/devalue

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

5.6.4

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cfw5-2vxh-hr84/GHSA-cfw5-2vxh-hr84.json"