`devalue`

Ecosystem:
npm

Package URL:
pkg:npm/devalue

Total PRs:
3,980 Dependabot PRs

Latest PR:
13 days ago

Unique Repositories:
3,237 repositories

Unique Repos (30 days):
1 repository

Security Advisories

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

GHSA-g2pg-6438-jwpf CVE-2026-22775 HIGH published 6 months ago • updated 2 days ago

## Summary Certain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in syste...

Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

GHSA-vw5p-8cq8-m7mv CVE-2026-22774 HIGH published 6 months ago • updated 2 days ago

## Summary Certain inputs can cause `devalue.parse` to consume excessive CPU time and/or memory, potentially leading to denial of service in syste...

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties

GHSA-mwv9-gp5h-frr4 LOW published 4 months ago • updated 27 days ago

In some circumstances, `devalue.parse` and `devalue.unflatten` could emit objects with `__proto__` own properties. This in and of itself is not a s...

devalue affected by CPU and memory amplification from sparse arrays

GHSA-33hq-fvwr-56pm LOW published 5 months ago • updated 2 months ago

Under certain circumstances, serializing sparse arrays using `uneval` or `stringify` could cause CPU and/or memory exhaustion. When this occurs on ...

devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

GHSA-8qm3-746x-r74r LOW published 5 months ago • updated 2 months ago

Under certain circumstances, `uneval`ing untrusted data can produce output code that will create objects with polluted prototypes when later `eval`...

View all 8 advisories

Recent PRs (filtered by: Patch PRs )

RSS Feed Clear filter

build(deps): bump devalue from 5.8.0 to 5.8.1

SecureLayer/tmp #3

5.8.0 → 5.8.1 Patch PR

Open about 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

srikanthsastry/srikanthsastry.github.io #134

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

namesakefyi/namesake #545

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1 in the npm_and_yarn group across 1 directory

bryan-hoang/bryanhoang.dev #30

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

graphql-hive/graphql-yoga #4494

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

Bump devalue from 5.8.0 to 5.8.1

bhargava16623/dependabot-alternatives-test #15

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1 in the npm_and_yarn group across 1 directory

almeidx/fogdex #28

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 14 updates

AKJUS/lucide #175

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 3 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 5 updates

nuxt-modules/og-image #607

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

Bassadin/funke-website #37

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

Sungblab/opencairn-monorepo #392

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

YKDZ/cat #1003

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

willfarrell/datastream #37

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

remeda/remeda #1350

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 4 comments

build(deps): bump devalue from 5.8.0 to 5.8.1

QingqiShi/uk-student-loan-study #418

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

infinitel8p/Extreme-InfiniTV #66

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

Bump devalue from 5.8.0 to 5.8.1

ykob/byte-sized-games #181

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

theritiktiwari/portfolio #40

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates

annazez/web #46

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

sembr/sembr.org #35

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

Ruthlessa/Mizuki #87

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 2 comments

Bump devalue from 5.8.0 to 5.8.1

rhanka/openerp #1

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1 in /docs

felixgeelhaar/coverctl #68

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

build(deps): bump devalue from 5.8.0 to 5.8.1

JULIANJUAREZMX01/MueveCancun #524

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

rhanka/sent-tech-design-system #5

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

build(deps): bump devalue from 5.8.0 to 5.8.1

SecureLayer/tmp #2

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

build(deps): bump devalue from 5.8.0 to 5.8.1

davidwkeith/pulletsforever.com #36

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1 in the npm_and_yarn group across 1 directory

irisariuan/budgetCalc #3

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

immutables/immutables.github.io #53

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

HendrikPrinsZA/HendrikPrinsZA #148

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

johnstont05/johnstont05.github.io #12

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

khammami/lgd-web #50

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1 in /frontend

packetThrower/PortFinder #46

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1 in /site

Aureliolo/synthorg #1912

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 3 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

minvws/nl-rdo-manon #1425

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

Deltamir/WebDevBootstrap #8

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 3 comments

Bump devalue from 5.8.0 to 5.8.1

theyosh/TerrariumPI #1101

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

build(deps): bump devalue from 5.8.0 to 5.8.1

Thomashighbaugh/thomasleonhighbaugh.me #523

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

Bump devalue from 5.8.0 to 5.8.1

OpenMaine/maineballot #449

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 2 comments

Bump devalue from 5.8.0 to 5.8.1

amemoia/buh.moe #44

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

SerenModz21/seren.dev #578

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

edwardjensen/edwardjensen-net-astro #19

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump devalue from 5.8.0 to 5.8.1

visbran/ippriv-astro #22

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

dm94/survpedia #45

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 2 comments

chore(deps): bump devalue from 5.8.0 to 5.8.1

adrianoamalfi/emdash-plugin-highlightjs #14

5.8.0 → 5.8.1 Patch PR

Open 2 months ago 1 comment

build(deps): bump devalue from 5.8.0 to 5.8.1

Forsakringskassan/prettier-config #60

5.8.0 → 5.8.1 Patch PR

Closed 2 months ago 1 comment

chore(deps): bump the npm_and_yarn group across 2 directories with 6 updates

Jonathangadeaharder/Notflix #62

5.6.2 → 5.6.4 Patch PR

Closed 3 months ago 2 comments

chore(deps): bump the npm_and_yarn group across 1 directory with 8 updates

18488292860-coder/workers-sdk #77

5.6.3 → 5.6.4 Patch PR

Closed 3 months ago 1 comment

Bump the npm_and_yarn group across 5 directories with 13 updates

RemyLoveLogicAI/huggingface.js #26

4.3.2 → 4.3.3 Patch PR

Open 3 months ago 7 comments

chore(deps): bump devalue from 5.7.0 to 5.7.1

Mergifyio/docs #10935

5.7.0 → 5.7.1 Patch PR

Open 4 months ago 2 comments

Package Details

Name:	`devalue`
Ecosystem:	npm
PURL Type:	npm
Package URL:	`pkg:npm/devalue`
JSON API:	View JSON

Security Advisories

8

Active advisories

HIGH 4

MODERATE 1

LOW 3

View All npm Advisories

Package Information

Description:

Gets the job done when JSON.stringify can't

Repository:	https://github.com/sveltejs/devalue
Homepage:	https://github.com/sveltejs/devalue#readme
Latest Release:	`5.3.2` 11 months ago
Dependent Repos:	52,279
Dependent Packages:	247
Downloads:	10,245,902
Ranking:	Top 0.142% by dependent repos Top 0.1609% by downloads Top 0.2265% by dependent pkgs

PR Status

Open 2,098 (52.7%)

Merged 545 (13.7%)

Closed 1,337 (33.6%)

PR Types

Major 286 (7.2%)

Minor 2,699 (67.8%)

Patch 980 (24.6%)

Removal 14 (0.4%)

devalue

Security Advisories

devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse

Devalue is vulnerable to denial of service due to memory exhaustion in devalue.parse

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `__proto__` own properties

devalue affected by CPU and memory amplification from sparse arrays

devalue `uneval`ed code can create objects with polluted prototypes when `eval`ed

Recent PRs (filtered by: Patch PRs )

Package Details

Security Advisories

8

Package Information

PR Status

PR Types

`devalue`

Sveltejs devalue's `devalue.parse` and `devalue.unflatten` emit objects with `proto` own properties