CVE-2026-123567

LowCVSS 3.7/10Last modified Nov 13, 2026

Description

Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__ own properties into objects returned by devalue.parse and devalue.unflatten. Attackers can supply crafted serialized input that, when downstream code merges results via Object.assign, alters the target object's prototype.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-1321

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Nov 8, 2026
Last modified: Nov 13, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-1235684.4Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object prototypes by supplying unt CVE-2026-1235697.5The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with uneval or stringify. An at CVE-2026-123577.2Heimdall Data Database Proxy generateFileContent CRLF Injection Remote Code Execution Vulnerability. This vulnerability allows remote attack CVE-2026-1235707.5The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized by the untrusted ANCO CVE-2026-1235717.5Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows remote attackers to tri CVE-2026-1235727.5Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation for CVE-2026-1235737.5hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS record presentation for CVE-2026-1235747.5The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a zone file is 4096 bytes CVE-2026-1235757.5Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks sufficient timeouts or CVE-2026-1235767.5Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume server resources by sen CVE-2026-1235777.5Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to consume server memory via CVE-2026-1235783.7Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP response's question section m