AIKIDO-2026-403281
devalue is vulnerable to Prototype Pollution
37
Low Risk
This Affects:
devalueTL;DR
parse and unflatten reject a null-prototype object key only when the key is the string __proto__. A non-string key that coerces to __proto__, such as an array or object, skips that comparison and is still assigned, so the result can have an own __proto__ property. That property does not modify Object.prototype by itself, but copying the result onto another object can replace that object's prototype. The fix rejects every non-string key before assignment.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application parses untrusted null-prototype objects with parse or unflatten.
Background info
devalue is vulnerable to Prototype Pollution in versions 0.0.1 - 5.9.2.
How to fix this
Upgrade the devalue library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.