Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| devalue | npm | >= 4.0.0, < 5.6.4 | 5.6.4 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the devalue library's parsing logic, specifically in the unflatten function, which is called by the public parse function. The vulnerability allows for the creation of objects with a __proto__ property from a specially crafted input string. This is a classic prototype pollution vector. If the object returned by devalue.parse is later used in an Object.assign or similar operation, it can lead to the pollution of the Object.prototype.
The patch, identified in commit 87c1f3ce3759765a061cfe34843ecc4b0711ba8d, addresses this by adding explicit checks within the unflatten function in src/parse.js. It now throws an error if it encounters a __proto__ key during the deserialization of an object, effectively preventing the creation of objects with this malicious property.
The identified vulnerable functions are unflatten (where the core logic flaw existed) and parse (the public-facing API that exposes the vulnerability). A runtime profiler would show a call to parse, which in turn calls unflatten, when the vulnerability is triggered.
