sveltejs @sveltejs/adapter-node vulnerabilities

Latest sveltejs @sveltejs/adapter-node CVEs

Newest publication first

1. CVE-2025-67647 SvelteKit Denial of service and possible SSRF when using prerendering

   Published 2026-01-15

   High·CVSS 8.4 EPSS 0.61%

   SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side request forgery (SSRF) and denial of service (DoS) under certain conditions. From 2.44.0 through 2.49.4, the vulnerability r...

2. CVE-2024-23641 Sending a GET or HEAD request with a body crashes SvelteKit

   Published 2024-01-24

   High·CVSS 7.5 EPSS 0.76%

   SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg {} to a built and previewed/hosted sveltekit app throws Request with GET/HEAD method cannot have body. and crashes the preview/hosting. After this happens, one must manually restart the app....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.