Sveltejs Kit
18 CVEs affecting Sveltejs Kit. Latest disclosed: 2026-08-28. Critical: 1, High: 9.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67647 | Critical | 9.1 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.49.5, SvelteKit is vulnerable to a server side req… |
CVE-2023-29008 | High | 8.8 | 2023-04-06 | The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.js` file, containing endpoint handlers for… |
CVE-2023-29003 | High | 8.8 | 2023-04-04 | SvelteKit is a web development framework. The SvelteKit framework offers developers an option to create simple REST APIs. This is done by defining a `+server.j… |
CVE-2026-82261 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form des… |
CVE-2026-82260 | High | 7.5 | 2026-08-28 | SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory ex… |
CVE-2026-82259 | High | 7.5 | 2026-08-28 | SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an app… |
CVE-2026-40074 | High | 7.5 | 2026-04-10 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, redirect, when called from inside the handle… |
CVE-2026-40073 | High | 7.5 | 2026-04-10 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.57.1, under certain circumstances, requests could… |
CVE-2026-22803 | High | 7.5 | 2026-01-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. From 2.49.0 to 2.49.4, the experimental form remote function… |
CVE-2024-23641 | High | 7.5 | 2024-01-24 | SvelteKit is a web development kit. In SvelteKit 2, sending a GET request with a body eg `{}` to a built and previewed/hosted sveltekit app throws `Request wit… |
CVE-2025-32388 | Medium | 5.4 | 2025-04-15 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.20.6 , unsanitized search param names cause XSS vu… |
CVE-2024-53262 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. The static error.html template for errors contains placeholde… |
CVE-2024-53261 | Medium | 5.4 | 2024-11-25 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. "Unsanitized input from *the request URL* flows into `end`, w… |
CVE-2026-82256 | Medium | 5.3 | 2026-08-28 | SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads… |
CVE-2026-66062 | Medium | 5.3 | 2026-08-07 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to 2.70.2, the content negotiation header parser used b… |
CVE-2026-82258 | Medium | 4.8 | 2026-08-28 | SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a sing… |
CVE-2026-82257 | Medium | 4.3 | 2026-08-28 | SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-control… |
CVE-2026-27118 | | 2026-02-20 | SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Versions of @sveltejs/adapter-vercel prior to 6.3.2 are vulne… |