Sveltejs Kit vulnerabilities
22 vulnerabilities
Known vulnerabilities in Sveltejs Kit, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
PrioritiseCVE-2026-114063sveltejs · kitSvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on WindowsSvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.CVSS8.7HighEPSS0.40%RoutineCVE-2026-114062sveltejs · kitSvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch FallbacksSvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests at their server, which redirects them to internal services.CVSS6.9MediumEPSS0.35%RoutineCVE-2026-114061sveltejs · kit +1 moreSvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered PagesSvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untrusted value at prerender time can break out of the content attribute and inject HTML or JavaScript that executes when users visit the page.CVSS4.7MediumEPSS0.21%RoutineCVE-2026-114060sveltejs · kit +1 moreSvelteKit before 3.0.0 Open Redirect via Enhanced Form ActionsSvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirect form results to navigate victims to attacker-controlled sites.CVSS4.7MediumEPSS0.20%PrioritiseCVE-2026-82261sveltejs · kit +2 moreSvelteKit before 2.52.2 CPU Exhaustion via Remote Form DeserializationSvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the request, resulting in denial of service. Fixed in 2.52.2.CVSS8.7HighEPSS0.49%PrioritiseCVE-2026-82260sveltejs · kit +2 moreSvelteKit before 2.52.2 Memory Exhaustion via Remote Form DeserializationSvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashing the server process and resulting in denial of service. Fixed in 2.52.2.CVSS8.7HighEPSS0.49%PrioritiseCVE-2026-82259sveltejs · kit +2 moreSvelteKit 2.49.0 before 2.53.3 Denial of Service via formSvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating files.length or individual file sizes, an attacker can submit relatively small inputs that expand into very large file arrays, leading to expensive processing and denial of service.CVSS8.7HighEPSS0.53%RoutineCVE-2026-82258sveltejs · kit +2 moreSvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batchSvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurrent requests.CVSS5.9MediumEPSS0.24%RoutineCVE-2026-82257sveltejs · kit +2 moreSvelteKit before 2.69.1 Prototype Pollution via File InputSvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling application functionality.CVSS5.3MediumEPSS0.36%RoutineCVE-2026-82256sveltejs · kit +2 moreSvelteKit before 2.69.1 Denial of Service via Remote FormSvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.CVSS6.9MediumEPSS0.42%RoutineCVE-2026-66062sveltejs · kit +1 moreSvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.CVSS5.3MediumEPSS0.51%RoutineCVE-2026-40074sveltejs · kit +2 moreSvelteKit's invalidated redirect in handle hook causes Denial-of-ServiceSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled TypeError. This could result in DoS on some platforms, especially if the location passed to redirect contains unsanitized user input. This vulnerability is fixed in 2.57.1.CVSS7.5HighEPSS0.37%PrioritiseCVE-2026-40073sveltejs · kit +2 moreSvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-nodeSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size limits at other layers of the application stack, so limits enforced in the WAF, gateway, or at the platform level are unaffected. This vulnerability is fixed in 2.57.1.CVSS8.2HighEPSS0.54%RoutineCVE-2026-27118sveltejs · kit +1 moreCache poisoning in @sveltejs/adapter-vercelSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulnerable to cache poisoning. An internal query parameter intended for Incremental Static Regeneration (ISR) is accessible on all routes, allowing an attacker to cause sensitive user-specific responses to be cached and served to other users. Successful exploitation requires a victim to visit an attacker-controlled link while authenticated. Existing deployments are protected by Vercel's WAF, but users should upgrade as soon as possible. This vulnerability is fixed in 6.3.2.CVSS5.3MediumEPSS0.28%PrioritiseCVE-2026-22803sveltejs · kit +2 moreSvelteKit has a memory amplification DoS in Remote Functions binary form deserializerSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function uses a binary data format containing a representation of submitted form data. A specially-crafted payload can cause the server to allocate a large amount of memory, causing DoS via memory exhaustion. This vulnerability is fixed in 2.49.5.CVSS8.2HighEPSS0.59%PrioritiseCVE-2025-67647sveltejs · kit +4 moreSvelteKit Denial of service and possible SSRF when using prerenderingSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route (export const prerender = true). From 2.19.0 through 2.49.4, the vulnerability results in a DoS when your app has at least one prerendered route and you are using adapter-node without a configured ORIGIN environment variable, and you are not using a reverse proxy that implements Host header validation. This vulnerability is fixed in 2.49.5.CVSS9.1CriticalEPSS0.52%RoutineCVE-2025-32388sveltejs · kit +1 moreSvelteKit allows XSS via tracked search_paramsSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vulnerability. You are affected if you iterate over all entries of event.url.searchParams inside a server load function. Attackers can exploit it by crafting a malicious URL and getting a user to click a link with said URL. This vulnerability is fixed in 2.20.6.CVSS5.4MediumEPSS0.30%RoutineCVE-2024-53261sveltejs · kit +2 moreCross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKitSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, where it is used to render an HTML page returned to the user. This may result in a Cross-Site Scripting attack (XSS)." The files `packages/kit/src/exports/vite/dev/index.js` and `packages/kit/src/exports/vite/utils.js` both contain user controllable data which under specific conditions may flow to dev mode pages. There is little to no expected impact. The Vite development is not exposed to the network by default and even if someone were able to trick a developer into executing an XSS against themselves, a development database should not have any sensitive data. None the less this issue has been addressed in version 2.8.3 and all users are advised to upgrade.CVSS5.4MediumEPSS0.35%RoutineCVE-2024-53262sveltejs · kit +2 moreUnescaped error message included on error page in SvelteKitSvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholders that are replaced without escaping the content first. error.html is the page that is rendered when everything else fails. It can contain the following placeholders: %sveltekit.status% — the HTTP status, and %sveltekit.error.message% — the error message. This leads to possible injection if an app explicitly creates an error with a message that contains user controlled content. Only applications where user provided input is used in the `Error` message will be vulnerable, so the vast majority of applications will not be vulnerable This issue has been addressed in version 2.8.3 and all users are advised to upgrade. There are no known workarounds for this vulnerability.CVSS5.4MediumEPSS0.51%PrioritiseCVE-2024-23641sveltejs · kit +4 moreSending a GET or HEAD request with a body crashes SvelteKitSvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request with GET/HEAD method cannot have body.` and crashes the preview/hosting. After this happens, one must manually restart the app. `TRACE` requests will also cause the app to crash. Prerendered pages and SvelteKit 1 apps are not affected. `@sveltejs/adapter-node` versions 2.1.2, 3.0.3, and 4.0.1 and `@sveltejs/kit` version 2.4.3 contain a patch for this issue.CVSS7.5HighEPSS0.76%