{"id":"CVE-2026-66062","aliases":["EUVD-2026-54557","GHSA-29g2-3rmr-qm68"],"status":"published","title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00507,"percentile":0.43534,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1333"],"published":"2026-08-07T16:49:43Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"npm","package":"@sveltejs/kit","fixed_in":["2.70.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.70.1"},{"fixed":"2.70.2"}]}]},{"source":"osv","ecosystem":"npm","package":"@sveltejs/kit","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.70.2"}]}]}],"products":[{"vendor":"sveltejs","product":"kit"}],"references":[{"url":"https://github.com/sveltejs/kit/security/advisories/GHSA-29g2-3rmr-qm68","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/sveltejs/kit/commit/82712fc02c24b1dcf5b25d7a52129cd8455f04f5","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/sveltejs/kit/releases/tag/@sveltejs/kit@2.70.2","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/advisories/GHSA-29g2-3rmr-qm68"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/66xxx/CVE-2026-66062.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-66062","tags":["advisory"]},{"url":"https://github.com/sveltejs/kit","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-66062","title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","status":"published","published":"2026-08-07T16:49:43.853Z","modified":"2026-08-07T21:02:12.997Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:20:12.939084Z"}],"euvd":[{"id":"EUVD-2026-54557","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","status":"published","published":"2026-08-07T16:49:43Z","modified":"2026-08-07T21:02:12Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:02:06.573967Z"}],"ghsa":[{"id":"GHSA-29g2-3rmr-qm68","title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"### Impact\nSvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.\n\n### Patches\nThe vulnerability is patched in `@sveltejs/kit` version 2.70.2.","status":"published","published":"2026-08-07T16:50:02Z","modified":"2026-08-07T16:50:04Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:40:57.999375Z"}],"nvd":[{"id":"CVE-2026-66062","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","status":"published","published":"2026-08-07T17:17:06.34Z","modified":"2026-10-24T16:10:00.153Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T14:12:35.386166Z"}],"osv":[{"id":"CVE-2026-66062","title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used by SvelteKit's request handling (for headers such as Accept) uses a regular expression vulnerable to quadratic backtracking, so a maliciously crafted header value can cause excessive CPU consumption and degrade or deny service. Version 2.70.2 fixes the issue.","status":"published","published":"2026-08-07T16:49:43.853Z","modified":"2026-10-28T02:30:49.832186609Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:45:14.46177Z"},{"id":"GHSA-29g2-3rmr-qm68","title":"SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header","description":"### Impact\nSvelteKit is vulnerable to remote CPU-exhaustion DoS attacks via specifically-crafted `Accept` headers. The impact is mitigated by default header length limits on most platforms, but in the case of raised or absent limits a denial of service is possible.\n\n### Patches\nThe vulnerability is patched in `@sveltejs/kit` version 2.70.2.","status":"published","published":"2026-08-07T16:50:02Z","modified":"2026-08-07T17:10:58.809703Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-1333"],"updated_at":"2026-11-02T15:46:33.956911Z"}]}}