Security
فارسی
All products

@sveltejs/kit

npm · Package
19 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
SvelteKit: URL redirection to untrusted site via enhanced form submissionCVE-2026-114060 · GHSA-PFHG-Q3QV-9Q6R @sveltejs/kit npm Low Fix reported
SvelteKit : XSS via untrusted cache-control header in prerendered pageCVE-2026-114061 · GHSA-27MW-82G8-PHJJ @sveltejs/kit npm Low Fix reported
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_paramsCVE-2025-32388 · GHSA-6Q87-84JW-CJHP @sveltejs/kit npm Medium Fix reported
@sveltejs/kit has unescaped error message included on error pageCVE-2024-53262 · GHSA-MH2X-FCQH-FMQV @sveltejs/kit npm Low Fix reported
Sending a GET or HEAD request with a body crashes SvelteKitCVE-2024-23641 · GHSA-G5M6-HXPP-FC49 @sveltejs/adapter-node@sveltejs/kit npm High Fix reported
SvelteKit framework has Insufficient CSRF protection for CORS requestsCVE-2023-29008 · GHSA-GV7G-X59X-WF8F @sveltejs/kit npm High Fix reported
SvelteKit vulnerable to Cross-Site Request ForgeryCVE-2023-29003 · GHSA-5P75-VC5G-8RV2 @sveltejs/kit npm High Fix reported
@sveltejs/kit: `query.batch` cross-talkCVE-2026-82258 · GHSA-HGV7-V322-MMGR @sveltejs/kit npm Medium Fix reported
Memory exhaustion in SvelteKit remote form deserialization (experimental only)CVE-2026-82260 · GHSA-VRHM-GVG7-FPCF @sveltejs/kit npm Medium Fix reported
CPU exhaustion in SvelteKit remote form deserialization (experimental only)CVE-2026-82261 · GHSA-88QP-P4QG-RQM6 @sveltejs/kit npm Medium Fix reported
SvelteKit: Big remote form function payloads can cause Node process to crashCVE-2026-82256 · GHSA-WQJV-9729-C5Q2 @sveltejs/kit npm Medium Fix reported
SvelteKit: Prototype pollution in file input deletion path in remote-function formsCVE-2026-82257 · GHSA-866W-XMHQ-WJ7X @sveltejs/kit npm Medium Fix reported
SvelteKit has deserialization expansion in unvalidated `form` remote function leading to Denial of Service (experimental only)CVE-2026-82259 · GHSA-FPG4-JHQR-589C @sveltejs/kit npm Low Fix reported
SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept headerCVE-2026-66062 · GHSA-29G2-3RMR-QM68 @sveltejs/kit npm Medium Fix reported
@sveltejs/adapter-node has a BODY_SIZE_LIMIT bypassCVE-2026-40073 · GHSA-2CRG-3P73-43XP @sveltejs/kit npm High Fix reported
@sveltejs/kit: Unvalidated redirect in handle hook causes Denial-of-ServiceCVE-2026-40074 · GHSA-3F6H-2HRP-W5WX @sveltejs/kit npm Medium Fix reported
SvelteKit is vulnerable to denial of service and possible SSRF when using prerenderingCVE-2025-67647 · GHSA-J62C-4X62-9R35 @sveltejs/adapter-node@sveltejs/kit npm High Fix reported
@sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sveltekit-formdata)CVE-2026-22803 · GHSA-J2F3-WQ62-6Q46 @sveltejs/kit npm High Fix reported
@sveltejs/kit vulnerable to XSS on dev mode 404 pageCVE-2024-53261 · GHSA-RJJV-87MX-6X3H @sveltejs/kit npm Low Fix reported