sveltejs vulnerabilities

Products

• @sveltejs/kit 28
• svelte 10
• devalue 7
• @sveltejs/adapter-node 2
• @sveltejs/adapter-vercel 1

Latest sveltejs CVEs

Newest publication first · page 1 of 2

1. CVE-2026-114062 SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks

   Published 2026-10-21

   Medium·CVSS 6.9 EPSS 0.35%

   SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach internal services because self-fetch fallbacks follow HTTP redirects automatically. Attackers can manipulate the Host or forwarded headers to point fallback requests...

2. CVE-2026-114063 SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows

   Published 2026-10-21

   High·CVSS 8.7 EPSS 0.40%

   SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through networ...

3. CVE-2026-114061 SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages

   Published 2026-10-21

   Low·CVSS 2.3 EPSS 0.21%

   SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a cache-control header value set via setHeaders is inserted without escaping into a <meta http-equiv="cache-control"> tag. An attacker who can influence that untruste...

4. CVE-2026-114060 SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions

   Published 2026-10-21

   Low·CVSS 2.1 EPSS 0.20%

   SvelteKit (@sveltejs/kit) before 3.0.0 contains an open redirect vulnerability in enhanced form actions (use:enhance) on routes accepting paths beginning with a double slash. Attackers can craft action paths starting with // that become protocol-relative URLs, causing non-redirec...

5. CVE-2026-92708 devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers

   Published 2026-09-18

   High·CVSS 7.5 EPSS 0.73%

   Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, stringify and uneval functions serialize a typed array by emitting its entire backing ArrayBuffer rather than only the vie...

6. CVE-2026-81176 Svelte devalue: DoS via malformed input

   Published 2026-09-16

   Medium·CVSS 5.3 EPSS 0.51%

   Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does not reject out-of-bounds indices that are greater than or equal to values.length in src/parse.js. A specially crafted un...

7. CVE-2026-82261 SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization

   Published 2026-08-28

   High·CVSS 8.7 EPSS 0.49%

   SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserialization. An attacker can send malformed form data to cause the server to become unresponsive while processing the re...

8. CVE-2026-82260 SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization

   Published 2026-08-28

   High·CVSS 8.7 EPSS 0.49%

   SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vulnerability in remote form deserialization. Malformed form data can cause excessive memory allocation, crashin...

9. CVE-2026-82258 SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch

   Published 2026-08-28

   Medium·CVSS 5.9 EPSS 0.24%

   SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request context. Attackers can exploit specific timing conditions to access sensitive data from other users' concurren...

10. CVE-2026-82259 SvelteKit 2.49.0 before 2.53.3 Denial of Service via form

    Published 2026-08-28

    High·CVSS 8.7 EPSS 0.53%

    SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application enables experimental.remoteFunctions and uses the form function to process the files array without validating fi...

11. CVE-2026-82257 SvelteKit before 2.69.1 Prototype Pollution via File Input

    Published 2026-08-28

    Medium·CVSS 5.3 EPSS 0.36%

    SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path names. Attackers can manipulate the deletion path to remove methods on the prototype, potentially disabling appl...

12. CVE-2026-82256 SvelteKit before 2.69.1 Denial of Service via Remote Form

    Published 2026-08-28

    Medium·CVSS 6.9 EPSS 0.42%

    SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated exploitation causes denial of service by repeatedly crashing the application process.

13. CVE-2026-66062 SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header

    Published 2026-08-07

    Medium·CVSS 5.3 EPSS 0.51%

    SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtrackin...

14. GHSA-866w-xmhq-wj7x SvelteKit: Prototype pollution in file input deletion path in remote-function forms

    Published 2026-07-24

    Medium·CVSS 4.3

    If you use remote form functions, have an input field of type file, and accept arbitrary user-controlled path names for the field, then you are vulnerable to a prototype pollution attack where the attacker can remove e.g. methods on the prototype.

15. GHSA-wqjv-9729-c5q2 SvelteKit: Big remote form function payloads can cause Node process to crash

    Published 2026-07-24

    Medium·CVSS 5.3

    Big remote form function payloads can cause the Node process to crash. Doing this repeatedly can cause DoS.

16. CVE-2026-42599 Cross-site scripting via spread attributes in Svelte SSR

    Published 2026-06-09

    Medium·CVSS 5.1 EPSS 0.21%

    Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler properties are included in the rendered HTML output. If an application spreads user-controlled or external data as element att...

17. CVE-2026-42567 Svelte: ReDoS in `<svelte:element>` Tag Validation

    Published 2026-06-09

    Medium·CVSS 5.9 EPSS 0.45%

    Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time to test in <svelte:element this={tag}></svelte:element>. This issue has been patched in version 5.55.7.

18. CVE-2026-42573 Svelte: XSS via DOM Clobbering of Internal Framework State

    Published 2026-06-09

    Medium·CVSS 5.3 EPSS 0.34%

    Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, potentially leading to XSS attacks. This issue has been patched in version 5.55.7.

19. CVE-2026-42570 Svelte devalue: DoS via sparse array deserialization

    Published 2026-06-09

    High·CVSS 7.5 EPSS 0.40%

    Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before version 5.8.1, devalue.parse could, due to quirks in some JavaScript engines, be convinced to allocate much more memory than w...

20. GHSA-hgv7-v322-mmgr @sveltejs/kit: `query.batch` cross-talk

    Published 2026-05-21

    Medium·CVSS 5.9

    query.batch() could, under very rare and specific timings, cause concurrent requests from different users to merge and resolve under single request context, enabling cross-user data disclosure.

21. CVE-2026-40074 SvelteKit's invalidated redirect in handle hook causes Denial-of-Service

    Published 2026-04-10

    Medium·CVSS 6.3 EPSS 0.37%

    SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle server hook with a location parameter containing characters that are invalid in a HTTP header, will cause an unhandled T...

22. CVE-2026-40073 SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node

    Published 2026-04-10

    High·CVSS 8.2 EPSS 0.55%

    SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could bypass the BODY_SIZE_LIMIT on SvelteKit applications running with adapter-node. This bypass does not affect body size lim...

23. CVE-2026-30226 devalue has prototype pollution in devalue.parse and devalue.unflatten

    Published 2026-03-11

    Medium·CVSS 6.3 EPSS 0.47%

    Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, devalue.parse and devalue.unflatten were susceptible to prototype pollution via maliciously crafted payloads. Successful exp...

24. GHSA-fpg4-jhqr-589c SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)

    Published 2026-02-28

    Low·CVSS 1.7

    Some relatively small inputs can cause very large files arrays in form handlers. If the SvelteKit application code doesn't check files.length or individual files' sizes and performs expensive processing with them, it can result in Denial of Service. Only users with experimental.r...

25. CVE-2026-27902 Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers

    Published 2026-02-26

    Medium·CVSS 5.3 EPSS 0.27%

    Svelte performance oriented web framework. Prior to version 5.53.5, errors from transformError were not correctly escaped prior to being embedded in the HTML output, causing potential HTML injection and XSS if attacker-controlled content is returned from transformError. Version 5...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.