@sveltejs/kit vulnerabilities (npm)
19 vulnerabilities.
-
@sveltejs/kitnpm SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages 2.3 Low -
@sveltejs/kitnpm SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions 2.1 Low -
@sveltejs/kitnpm SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header 5.3 Medium -
@sveltejs/kitnpm SvelteKit before 2.69.1 Prototype Pollution via File Input 5.3 Medium -
@sveltejs/kitnpm SvelteKit before 2.69.1 Denial of Service via Remote Form 6.9 Medium -
@sveltejs/kitnpm SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch 5.9 Medium -
@sveltejs/kitnpm SvelteKit's invalidated redirect in handle hook causes Denial-of-Service 6.3 Medium -
@sveltejs/kitnpm SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node 8.2 High -
@sveltejs/kitnpm SvelteKit 2.49.0 before 2.53.3 Denial of Service via form 8.7 High -
@sveltejs/kitnpm SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization 8.7 High -
@sveltejs/kitnpm SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization 8.7 High -
@sveltejs/kitnpm SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer 8.2 High -
@sveltejs/kitnpm SvelteKit Denial of service and possible SSRF when using prerendering 8.4 High -
@sveltejs/kitnpm SvelteKit allows XSS via tracked search_params 5.4 Medium -
@sveltejs/kitnpm Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit 2.0 Low -
@sveltejs/kitnpm Unescaped error message included on error page in SvelteKit 2.0 Low -
@sveltejs/kitnpm Sending a GET or HEAD request with a body crashes SvelteKit 7.5 High -
@sveltejs/kitnpm SvelteKit framework has Insufficient CSRF protection for CORS requests 8.8 High -
@sveltejs/kitnpm SvelteKit has Insufficient Cross-Site Request Forgery Protection 8.8 High