CVE-2025-57820: Svelte Devalue Prototype Pollution Flaw

CVE-2025-57820 Overview

CVE-2025-57820 is a prototype pollution vulnerability in Svelte devalue, a JavaScript utility library used to serialize and deserialize complex data structures. Versions prior to 5.3.2 accept a string passed to devalue.parse that represents an object with a __proto__ property. The devalue.parse function does not validate that an index is numeric. Attackers can assign prototypes to objects and properties, polluting the JavaScript prototype chain. The flaw is categorized under CWE-1321: Improperly Controlled Modification of Object Prototype Attributes. Maintainers fixed the issue in devalue version 5.3.2.

Critical Impact
Attackers can pollute the JavaScript Object.prototype through crafted devalue.parse input, affecting downstream application logic and potentially enabling code execution or authentication bypass in applications that consume devalue output.

Affected Products

Svelte devalue versions prior to 5.3.2
SvelteKit applications that deserialize untrusted input using devalue.parse
Node.js and browser-side JavaScript projects that depend on devalue for data hydration

Discovery Timeline

2025-08-26 - CVE-2025-57820 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-57820

Vulnerability Analysis

The devalue library serializes JavaScript values, including cyclic references and built-in types, into a JSON-compatible representation. The parse function reverses this process by walking an array of nodes and hydrating objects based on numeric indices. The vulnerability stems from two combined defects in the parsing logic. First, the parser does not reject objects containing a __proto__ key in their serialized representation. Second, the parser does not verify that the index used to look up a node is a number. An attacker who controls the input to devalue.parse can pass a crafted payload that assigns a prototype to an object during hydration. The polluted prototype then propagates to every object in the JavaScript runtime, altering behavior of subsequent property lookups across the application.

Root Cause

The root cause is missing input validation in src/parse.js. The hydrate routine treats any value retrieved by index as a valid node reference without type-checking the index or filtering reserved property names such as __proto__. Combined with the lack of a __proto__ filter on object keys, this allows the attacker-supplied structure to reach into the prototype chain during hydration.

Attack Vector

Exploitation requires that an application pass attacker-controlled data into devalue.parse. This is common in server-rendered Svelte and SvelteKit applications that deserialize form payloads, query parameters, or session data. No authentication or user interaction is required. The attack is delivered over the network through any input channel that reaches devalue.parse.

javascript

// Patch applied in src/parse.js (commit 0623a47)
// Source: https://github.com/sveltejs/devalue/commit/0623a47c9555b639c03ff1baea82951b2d9d1132

		if (index === NEGATIVE_INFINITY) return -Infinity;
		if (index === NEGATIVE_ZERO) return -0;

-		if (standalone) throw new Error(`Invalid input`);
+		if (standalone || typeof index !== 'number') {
+			throw new Error(`Invalid input`);
+		}

		if (index in hydrated) return hydrated[index];

The patch adds a typeof index !== 'number' check, rejecting any node reference that is not a numeric index. This blocks the prototype assignment path that the original code permitted. See the GitHub Security Advisory GHSA-vj54-72f3-p5jv for the full advisory.

Detection Methods for CVE-2025-57820

Indicators of Compromise

Inbound HTTP requests or WebSocket messages containing the literal string __proto__ directed at SvelteKit endpoints that perform server-side hydration
Application errors referencing unexpected property values on built-in objects after processing user-supplied serialized data
Runtime behavior changes such as authentication checks passing for previously rejected accounts, indicating polluted prototype properties

Detection Strategies

Audit package-lock.json and pnpm-lock.yaml for devalue versions below 5.3.2 across all projects
Add static analysis rules to flag calls to devalue.parse whose argument originates from request bodies, cookies, headers, or query strings
Monitor application logs for parser exceptions thrown from devalue after upgrading, since the patched version raises Invalid input on the malicious payload pattern

Monitoring Recommendations

Instrument runtime monitoring of Object.prototype to alert on unexpected enumerable property additions during request processing
Forward web application firewall (WAF) logs containing __proto__ or constructor.prototype tokens to a central detection pipeline for review
Track dependency advisories from the sveltejs/devalue repository and the npm advisory database to identify regressions or related fixes

How to Mitigate CVE-2025-57820

Immediate Actions Required

Upgrade devalue to version 5.3.2 or later in every direct and transitive dependency tree
Identify all code paths that invoke devalue.parse on untrusted input and treat the input as hostile until validated
Rebuild and redeploy SvelteKit and Svelte server applications that bundle devalue to ensure the patched version is shipped to production

Patch Information

The maintainers released the fix in devalue version 5.3.2. The corrective change is in commit 0623a47c9555b639c03ff1baea82951b2d9d1132, which adds a strict numeric type check on the index value during hydration. Update with npm install devalue@^5.3.2 or the equivalent command for your package manager.

Workarounds

If immediate upgrade is not possible, wrap calls to devalue.parse with a pre-parse JSON scan that rejects payloads containing the substring "__proto__" or "constructor"
Apply Object.freeze(Object.prototype) early in the application bootstrap to prevent runtime prototype modification
Place a WAF rule in front of affected endpoints to block request bodies and query strings containing __proto__ tokens

bash

# Upgrade devalue to the patched version
npm install devalue@^5.3.2

# Verify the installed version
npm ls devalue

# Audit the dependency tree for vulnerable transitive copies
npm audit --production