Vulnerability	Vulnerable Version
C Prototype Pollution devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Prototype Pollution via the `parse` function. An attacker can manipulate object prototypes or assign array prototype methods to object properties by crafting malicious payloads, potentially leading to property overwrites or bypassing server-side validation. How to fix Prototype Pollution? Upgrade `devalue` to version 5.3.2 or higher.	<5.3.2
M Cross-site Scripting (XSS) devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set. Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. How to fix Cross-site Scripting (XSS)? Upgrade `devalue` to version 2.0.1 or higher.	<2.0.1

Prototype Pollution

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Prototype Pollution via the parse function. An attacker can manipulate object prototypes or assign array prototype methods to object properties by crafting malicious payloads, potentially leading to property overwrites or bypassing server-side validation.

How to fix Prototype Pollution?

Upgrade devalue to version 5.3.2 or higher.

<5.3.2

Cross-site Scripting (XSS)

devalue is a JSON.stringify, but handles cyclical references, repeated references, undefined, regular expressions, dates, Map and Set.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions.

How to fix Cross-site Scripting (XSS)?

Upgrade devalue to version 2.0.1 or higher.

<2.0.1

Go back to all versions of this package