Sveltejs vulnerabilities

Products

• Kit 22
• Svelte 12
• Devalue 7

Newest

• sveltejs devalue Devalue before 5.6.3 Denial of Service via Sparse Array Serialization CVE-2026-123569 8.7 HighNovember 8, 2026
• sveltejs devalue Sveltejs devalue before 5.6.3 Prototype Pollution via uneval Output CVE-2026-123568 2.1 LowNovember 8, 2026
• sveltejs devalue Sveltejs devalue before 5.6.4 Prototype Injection via parse and unflatten CVE-2026-123567 6.3 MediumNovember 8, 2026
• sveltejs devalue Devalue before 5.9.3 CPU Amplification Denial of Service via uneval CVE-2026-123566 8.7 HighNovember 8, 2026
• sveltejs devalue Devalue before 5.9.3 Quadratic Expansion Denial of Service via uneval CVE-2026-123565 8.7 HighNovember 8, 2026
• sveltejs devalue Sveltejs devalue before 5.9.3 Memory Exhaustion via uneval Sparse Arrays CVE-2026-123564 8.7 HighNovember 8, 2026
• sveltejs devalue Devalue before 5.9.3 Typed-Array Allocation Validation Bypass via parse CVE-2026-123563 8.7 HighNovember 8, 2026
• sveltejs devalue Devalue 5.8.0 before 5.9.3 Denial of Service via stringifyAsync Unhandled Rejection CVE-2026-123562 8.7 HighNovember 8, 2026
• sveltejs devalue Sveltejs devalue before 5.9.3 __proto__ Rejection Bypass via Property-Key Coercion CVE-2026-123561 6.3 MediumNovember 8, 2026
• sveltejs kit SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows CVE-2026-114063 8.7 HighOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks CVE-2026-114062 6.9 MediumOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages CVE-2026-114061 Fix available 2.3 LowOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions CVE-2026-114060 Fix available 2.1 LowOctober 21, 2026
• sveltejs devalue devalue: Cross-request process memory disclosure in devalue when `stringify` / `uneval` serialize Node Buffers CVE-2026-92708 Fix available 7.5 HighSeptember 18, 2026
• sveltejs kit SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header CVE-2026-66062 Fix available 5.3 MediumAugust 7, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Prototype Pollution via File Input CVE-2026-82257 Fix available 5.3 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Denial of Service via Remote Form CVE-2026-82256 Fix available 6.9 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch CVE-2026-82258 Fix available 5.9 MediumMay 21, 2026
• svelte, red hat build of podman desktop +1 more Svelte: XSS via DOM Clobbering of Internal Framework State CVE-2026-42573 Fix available 5.3 MediumMay 14, 2026
• svelte Svelte: ReDoS in `<svelte:element>` Tag Validation CVE-2026-42567 Fix available 5.9 MediumMay 14, 2026
• svelte devalue, red hat build of podman desktop, enterprise linux 10 +1 more +3 more Svelte devalue: DoS via sparse array deserialization CVE-2026-42570 Fix available 7.5 HighMay 14, 2026
• svelte Cross-site scripting via spread attributes in Svelte SSR CVE-2026-42599 Fix available 5.1 MediumMay 14, 2026
• svelte kit SvelteKit's invalidated redirect in handle hook causes Denial-of-Service CVE-2026-40074 Fix available 6.3 MediumApril 10, 2026
• svelte kit SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node CVE-2026-40073 Fix available 8.2 HighApril 10, 2026
• svelte devalue devalue has prototype pollution in devalue.parse and devalue.unflatten CVE-2026-30226 Fix available 6.3 MediumMarch 11, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.49.0 before 2.53.3 Denial of Service via form CVE-2026-82259 Fix available 8.7 HighFebruary 28, 2026
• svelte Svelte Vulnerable to XSS via HTML Comment Injection in SSR Error Boundary Hydration Markers CVE-2026-27902 Fix available 5.3 MediumFebruary 26, 2026
• svelte Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` CVE-2026-27901 Fix available 5.3 MediumFebruary 26, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization CVE-2026-82261 Fix available 8.7 HighFebruary 19, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization CVE-2026-82260 Fix available 8.7 HighFebruary 19, 2026
• sveltejs devalue Svelte devalue: DoS via malformed input CVE-2026-81176 Fix available 5.3 MediumFebruary 19, 2026
• svelte Svelte SSR attribute spreading includes inherited properties from prototype chain CVE-2026-27125 Fix available 5.3 MediumFebruary 19, 2026
• svelte Svelte SSR does not validate dynamic element tag names in `<svelte:element>` CVE-2026-27122 Fix available 5.1 MediumFebruary 19, 2026
• svelte Svelte affected by cross-site scripting via spread attributes in Svelte SSR CVE-2026-27121 Fix available 5.1 MediumFebruary 19, 2026
• svelte Svelte affected by XSS in SSR `<option>` element CVE-2026-27119 Fix available 5.1 MediumFebruary 19, 2026
• sveltejs kit Cache poisoning in @sveltejs/adapter-vercel CVE-2026-27118 Fix available 5.3 MediumFebruary 19, 2026
• svelte Svelte 5.46.0 - Hydratable Key Script-Breakout XSS (SSR) CVE-2025-15265 Fix available 5.3 MediumJanuary 15, 2026
• svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory/CPU exhaustion in devalue.parse CVE-2026-22775 Fix available 7.5 HighJanuary 15, 2026
• svelte kit SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer CVE-2026-22803 Fix available 8.2 HighJanuary 15, 2026
• svelte devalue, red hat build of podman desktop - tech preview, trusted artifact signer 1.2 +1 more +3 more devalue vulnerable to denial of service due to memory exhaustion in devalue.parse CVE-2026-22774 Fix available 7.5 HighJanuary 15, 2026
• svelte adapter-node, kit +1 more SvelteKit Denial of service and possible SSRF when using prerendering CVE-2025-67647 Fix available 8.4 HighJanuary 15, 2026
• sveltejs devalue Svelte devalue vulnerable to prototype pollution CVE-2025-57820 Fix available 7.9 HighAugust 26, 2025
• sveltejs kit SvelteKit allows XSS via tracked search_params CVE-2025-32388 Fix available 5.4 MediumApril 14, 2025
• svelte sveltekit, sveltejs kit +1 more Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit CVE-2024-53261 Fix available 2.0 LowNovember 25, 2024
• svelte sveltekit, sveltejs kit +1 more Unescaped error message included on error page in SvelteKit CVE-2024-53262 Fix available 2.0 LowNovember 25, 2024
• svelte Potential mXSS vulnerability due to improper HTML escaping in svelte CVE-2024-45047 Fix available 5.4 MediumAugust 30, 2024
• svelte adapter-node, kit +1 more Sending a GET or HEAD request with a body crashes SvelteKit CVE-2024-23641 Fix available 7.5 HighJanuary 24, 2024
• svelte sveltekit, sveltejs kit +1 more SvelteKit framework has Insufficient CSRF protection for CORS requests CVE-2023-29008 Fix available 8.8 HighApril 6, 2023
• svelte sveltekit, sveltejs kit +1 more SvelteKit has Insufficient Cross-Site Request Forgery Protection CVE-2023-29003 Fix available 8.8 HighApril 4, 2023
• svelte Cross-site Scripting (XSS) CVE-2022-25875 Fix available 5.4 MediumJuly 12, 2022