CVE-2026-123561Low· 3.7▾ Sunlitdevalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects wit…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 20.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's proto rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a proto own property, which alone does not cause prototype pollution.
devalue < 5.9.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
GHSA-4q55-j62x-fr9hMediumdevalue: Malformed null-prototype object keys bypass __proto__ rejection via property-key coercion
CVE-2026-123568Medium· 4.4Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output
CVE-2026-123567Low· 3.7Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten
CVE-2026-123562High· 7.5Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection
CVE-2026-123564High· 7.5Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays
CVE-2026-123563High· 7.5Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse