Bug 2446675 (CVE-2026-30226) - CVE-2026-30226 devalue: Devalue: Denial of Service or type confusion via prototype pollution
Summary: CVE-2026-30226 devalue: Devalue: Denial of Service or type confusion via prot...
Keywords:
Status: NEW
Alias: CVE-2026-30226
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-03-11 18:01 UTC by OSIDB Bzimport
Modified: 2026-03-12 11:25 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-03-11 18:01:35 UTC 
Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.
Note You need to log in before you can comment on or make changes to this bug.