CVE-2026-123561
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 08, 2026
Vendor
unknown
Description
devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through property-key coercion, an incomplete fix for GHSA-mwv9-gp5h-frr4. Attackers can supply crafted payloads that yield objects with a __proto__ own property, which alone does not cause prototype pollution.