Prototype pollution vulnerability in Svelte devalue’s parse and unflatten functions allows maliciously crafted payloads to overwrite objects on the prototype chain. This can result in denial of service by breaking the library’s logic or type confusion that may lead to incorrect type handling within applications that rely on devalue for serialization and deserialization. The weakness is identified as CWE-1321 (Prototype Pollution) and CWE-843 (Type Confusion).

The vulnerability affects the Svelte JavaScript library devalue, specifically versions v5.6.3 and all earlier releases. The affected package is identified by the CPE cpe:2.3:a:svelte:devalue:*:*:*:*:*:node.js:*. Users employing these versions should consider upgrading to a patched release.

The CVSS score of 6.3 indicates moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation in the wild. The CVE is not listed in CISA’s Known Exploited Vulnerabilities catalog, further implying limited active exploitation. A potential attacker would need to deliver a specially crafted payload to devalue.parse or devalue.unflatten, which typically involves JavaScript code execution within a Node.js environment or a front‑end application that uses devalue. The risk can be mitigated by applying the vendor’s patch or by restricting the use of these functions to trusted input only.