Sveltejs Kit vulnerabilities

• sveltejs kit SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows CVE-2026-114063 8.7 HighOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 SSRF via Redirects in Server-Side Self-Fetch Fallbacks CVE-2026-114062 6.9 MediumOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages CVE-2026-114061 Fix available 2.3 LowOctober 21, 2026
• sveltejs kit SvelteKit before 3.0.0 Open Redirect via Enhanced Form Actions CVE-2026-114060 Fix available 2.1 LowOctober 21, 2026
• sveltejs kit SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header CVE-2026-66062 Fix available 5.3 MediumAugust 7, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Prototype Pollution via File Input CVE-2026-82257 Fix available 5.3 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.69.1 Denial of Service via Remote Form CVE-2026-82256 Fix available 6.9 MediumJuly 24, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch CVE-2026-82258 Fix available 5.9 MediumMay 21, 2026
• svelte kit SvelteKit's invalidated redirect in handle hook causes Denial-of-Service CVE-2026-40074 Fix available 6.3 MediumApril 10, 2026
• svelte kit SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node CVE-2026-40073 Fix available 8.2 HighApril 10, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit 2.49.0 before 2.53.3 Denial of Service via form CVE-2026-82259 Fix available 8.7 HighFebruary 28, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization CVE-2026-82261 Fix available 8.7 HighFebruary 19, 2026
• svelte sveltekit, sveltejs kit +1 more SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization CVE-2026-82260 Fix available 8.7 HighFebruary 19, 2026
• sveltejs kit Cache poisoning in @sveltejs/adapter-vercel CVE-2026-27118 Fix available 5.3 MediumFebruary 19, 2026
• svelte kit SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer CVE-2026-22803 Fix available 8.2 HighJanuary 15, 2026
• svelte adapter-node, kit +1 more SvelteKit Denial of service and possible SSRF when using prerendering CVE-2025-67647 Fix available 8.4 HighJanuary 15, 2026
• sveltejs kit SvelteKit allows XSS via tracked search_params CVE-2025-32388 Fix available 5.4 MediumApril 14, 2025
• svelte sveltekit, sveltejs kit +1 more Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit CVE-2024-53261 Fix available 2.0 LowNovember 25, 2024
• svelte sveltekit, sveltejs kit +1 more Unescaped error message included on error page in SvelteKit CVE-2024-53262 Fix available 2.0 LowNovember 25, 2024
• svelte adapter-node, kit +1 more Sending a GET or HEAD request with a body crashes SvelteKit CVE-2024-23641 Fix available 7.5 HighJanuary 24, 2024
• svelte sveltekit, sveltejs kit +1 more SvelteKit framework has Insufficient CSRF protection for CORS requests CVE-2023-29008 Fix available 8.8 HighApril 6, 2023
• svelte sveltekit, sveltejs kit +1 more SvelteKit has Insufficient Cross-Site Request Forgery Protection CVE-2023-29003 Fix available 8.8 HighApril 4, 2023