Sveltejs vulnerabilities
39 vulnerabilities
Known vulnerabilities in Sveltejs products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3PrioritiseCVE-2026-114063sveltejs · kitSvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on WindowsSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.CVSS8.7HighEPSS0.40%RoutineCVE-2026-114062sveltejs · kitSvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch FallbacksSvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.CVSS6.9MediumEPSS0.35%RoutineCVE-2026-114061sveltejs · kit +1 moreSvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered PagesSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.CVSS4.7MediumEPSS0.21%RoutineCVE-2026-114060sveltejs · kit +1 moreSvelteKit before 3.0.0 Open Redirect via Enhanced Form ActionsSvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.CVSS4.7MediumEPSS0.20%PrioritiseCVE-2026-92708sveltejs · devalue +1 moredevalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node BuffersSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the view, so serializing a Node Buffer, whose backing store is a process-wide shared pool, discloses up to 64 KB of unrelated process memory, including bytes from other in-flight requests. In a server-side-rendered framework such as SvelteKit or Nuxt, a public page whose load() returns a small Buffer, or that reads a small file, can therefore ship another user's request body or Authorization header in its HTML without authentication. Because this occurs during serialization, it fires on every such render and is not mitigated by the parse/unflatten prototype-pollution and denial-of-service guards, which only apply when parsing untrusted input. As a workaround, convert Node Buffer objects to Uint8Array before serialization. This issue has been fixed in version 5.9.3.CVSS7.5HighEPSS0.73%RoutineCVE-2026-81176sveltejs · devalue +1 moreSvelte devalue: DoS via malformed inputSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted untrusted payload can make the parser alternate between array representations, producing quadratic work as the payload grows and causing denial of service in applications that parse untrusted devalue data. This issue is fixed in version 5.9.2.CVSS5.3MediumEPSS0.51%PrioritiseCVE-2026-82261sveltejs · kit +2 moreSvelteKit before 2.52.2 CPU Exhaustion via Remote Form DeserializationSvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.CVSS8.7HighEPSS0.49%PrioritiseCVE-2026-82260sveltejs · kit +2 moreSvelteKit before 2.52.2 Memory Exhaustion via Remote Form DeserializationSvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.CVSS8.7HighEPSS0.49%PrioritiseCVE-2026-82259sveltejs · kit +2 moreSvelteKit 2.49.0 before 2.53.3 Denial of Service via formSvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.CVSS8.7HighEPSS0.53%RoutineCVE-2026-82258sveltejs · kit +2 moreSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchSvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.CVSS5.9MediumEPSS0.24%RoutineCVE-2026-82257sveltejs · kit +2 moreSvelteKit before 2.69.1 Prototype Pollution via File InputSvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.CVSS5.3MediumEPSS0.36%RoutineCVE-2026-82256sveltejs · kit +2 moreSvelteKit before 2.69.1 Denial of Service via Remote FormSvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.CVSS6.9MediumEPSS0.42%RoutineCVE-2026-66062sveltejs · kit +1 moreSvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.CVSS5.3MediumEPSS0.51%RoutineCVE-2026-42599sveltejs · svelte +5 moreCross-site scripting via spread attributes in Svelte SSRSvelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element attributes, an attacker can inject malicious event handlers that execute in victims' browsers. Note that this vulnerability only triggers if the user's browser has JavaScript enabled but Svelte's hydration mechanism does not reach the vulnerable element before the event fires. This issue has been patched in version 5.55.7.CVSS6.1MediumEPSS0.21%RoutineCVE-2026-42567sveltejs · svelte +2 moreSvelte: ReDoS in `<svelte:element>` Tag ValidationSvelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.CVSS7.5HighEPSS0.45%RoutineCVE-2026-42573sveltejs · svelte +5 moreSvelte: XSS via DOM Clobbering of Internal Framework StateSvelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.CVSS8.1HighEPSS0.34%PrioritiseCVE-2026-42570sveltejs · devalue +2 moreSvelte devalue: DoS via sparse array deserializationSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than was needed when deserializing sparse arrays, leading to excessive memory consumption. This issue has been patched in version 5.8.1.CVSS7.5HighEPSS0.40%RoutineCVE-2026-40074sveltejs · kit +2 moreSvelteKit's invalidated redirect in handle hook causes Denial-of-ServiceSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.CVSS7.5HighEPSS0.37%PrioritiseCVE-2026-40073sveltejs · kit +2 moreSvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodeSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.CVSS8.2HighEPSS0.54%RoutineCVE-2026-30226sveltejs · devalue +2 moredevalue has prototype pollution in devalue.parse and devalue.unflattenSvelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exploitation could lead to Denial of Service (DoS) or type confusion. This vulnerability is fixed in 5.6.4.CVSS7.5HighEPSS0.42%