CVE-2026-92708 | High | 7.5 | 2026-09-18 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In versions 5.1.0 through 5.9.2, s… |
CVE-2026-81176 | Medium | 5.3 | 2026-09-16 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. Prior to 5.9.2, devalue.parse does… |
CVE-2026-82261 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form des… |
CVE-2026-82260 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory ex… |
CVE-2026-82259 | High | 7.5 | 2026-08-28 | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an app… |
CVE-2026-82258 | Medium | 4.8 | 2026-08-28 | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing… |
CVE-2026-82257 | Medium | 4.3 | 2026-08-28 | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-control… |
CVE-2026-82256 | Medium | 5.3 | 2026-08-28 | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads… |
CVE-2026-66062 | Medium | 5.3 | 2026-08-07 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used b… |
CVE-2026-42599 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, when using spread syntax to render attributes from untrusted data, event handler prope… |
CVE-2026-42573 | Medium | 6.1 | 2026-06-09 | Svelte is a performance oriented web framework. Prior to version 5.55.7, Svelte was vulnerable to DOM clobbering of its internal framework state on elements, p… |
CVE-2026-42570 | High | 7.5 | 2026-06-09 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From version 5.6.3 to before versi… |
CVE-2026-42567 | High | 7.5 | 2026-06-09 | Svelte is a performance oriented web framework. From version 5.51.5 to before version 5.55.7, an internal regex in the Svelte runtime can take exponential time… |
CVE-2026-40074 | High | 7.5 | 2026-04-10 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle… |
CVE-2026-40073 | High | 7.5 | 2026-04-10 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could… |
CVE-2026-30226 | High | 7.5 | 2026-03-11 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. In devalue v5.6.3 and earlier, dev… |
CVE-2026-27902 | Medium | 5.4 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, errors from `transformError` were not correctly escaped prior to being embedded in the HTML… |
CVE-2026-27901 | Medium | 6.1 | 2026-02-26 | Svelte performance oriented web framework. Prior to version 5.53.5, the contents of `bind:innerText` and `bind:textContent` on `contenteditable` elements were… |
CVE-2026-27125 | Medium | 6.8 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, in server-side rendering, attribute spreading on elements (e.g. <div {...attrs}>) enumerates inheri… |
CVE-2026-27122 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Prior to 5.51.5, when using <svelte:element this={tag}> in server-side rendering, the provided tag name is not valid… |
CVE-2026-27121 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. Versions of svelte prior to 5.51.5 are vulnerable to cross-site scripting (XSS) during server-side rendering. When u… |
CVE-2026-27119 | Medium | 5.4 | 2026-02-20 | svelte performance oriented web framework. From 5.39.3, <=5.51.4, in certain circumstances, the server-side rendering output of an <option> element does not pr… |
CVE-2026-27118 | | | 2026-02-20 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulne… |
CVE-2026-22803 | High | 7.5 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function… |
CVE-2026-22775 | High | 7.5 | 2026-01-15 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.1.0 to 5.6.1, certain input… |
CVE-2026-22774 | High | 7.5 | 2026-01-15 | Svelte devalue is a JavaScript library that serializes values into strings when JSON.stringify isn't sufficient for the job. From 5.3.0 to 5.6.1, certain input… |
CVE-2025-67647 | Critical | 9.1 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side req… |
CVE-2025-57820 | | | 2025-08-26 | Svelte devalue is a utility library. Prior to version 5.3.2, a string passed to devalue.parse could represent an object with a __proto__ property and devalue.p… |
CVE-2025-32388 | Medium | 5.4 | 2025-04-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vu… |
CVE-2024-53262 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholde… |
CVE-2024-53261 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, w… |
CVE-2024-45047 | Medium | 5.4 | 2024-08-30 | svelte performance oriented web framework. A potential mXSS vulnerability exists in Svelte for versions up to but not including 4.2.19. Svelte improperly escap… |
CVE-2024-23641 | High | 7.5 | 2024-01-24 | SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request wit… |
CVE-2023-29008 | High | 8.8 | 2023-04-06 | The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for… |
CVE-2023-29003 | High | 8.8 | 2023-04-04 | SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.j… |