Svelte Kit vulnerabilities

• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Prototype Pollution via File Input CVE-2026-82257 Fix available 5.3 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Denial of Service via Remote Form CVE-2026-82256 Fix available 6.9 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch CVE-2026-82258 Fix available 5.9 MediumMay 21, 2026
• svelte kit SvelteKit's invalidated redirect in handle hook causes Denial-of-Service CVE-2026-40074 Fix available 6.3 MediumApril 10, 2026
• svelte kit SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node CVE-2026-40073 Fix available 8.2 HighApril 10, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.49.0 before 2.53.3 Denial of Service via form CVE-2026-82259 Fix available 8.7 HighFebruary 28, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization CVE-2026-82261 Fix available 8.7 HighFebruary 19, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization CVE-2026-82260 Fix available 8.7 HighFebruary 19, 2026
• svelte kit SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer CVE-2026-22803 Fix available 8.2 HighJanuary 15, 2026
• svelte adapter-node, kit +1 more SvelteKit Denial of service and possible SSRF when using prerendering CVE-2025-67647 Fix available 8.4 HighJanuary 15, 2026
• svelte sveltekit, sveltejs kit +1 more Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit CVE-2024-53261 Fix available 2.0 LowNovember 25, 2024
• svelte sveltekit, sveltejs kit +1 more Unescaped error message included on error page in SvelteKit CVE-2024-53262 Fix available 2.0 LowNovember 25, 2024
• svelte adapter-node, kit +1 more Sending a GET or HEAD request with a body crashes SvelteKit CVE-2024-23641 Fix available 7.5 HighJanuary 24, 2024
• svelte sveltekit, sveltejs kit +1 more SvelteKit framework has Insufficient CSRF protection for CORS requests CVE-2023-29008 Fix available 8.8 HighApril 6, 2023
• svelte sveltekit, sveltejs kit +1 more SvelteKit has Insufficient Cross-Site Request Forgery Protection CVE-2023-29003 Fix available 8.8 HighApril 4, 2023