Kit
Svelte · 5 CVEs
CVE-2026-40074
MEDIUM
SvelteKit's invalidated redirect in handle hook causes Denial-of-Service
Apr 10, 2026
CVE-2026-40073
HIGH
SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node
Apr 10, 2026
CVE-2026-22803
HIGH
SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer
Jan 15, 2026
CVE-2025-67647
HIGH
SvelteKit Denial of service and possible SSRF when using prerendering
Jan 15, 2026
CVE-2024-23641
HIGH
Sending a GET or HEAD request with a body crashes SvelteKit
Jan 24, 2024
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-40074 | SvelteKit's invalidated redirect in handle hook causes Denial-of-Service | MEDIUM | 0.61% | Apr 10, 2026 |
| CVE-2026-40073 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | HIGH | 0.95% | Apr 10, 2026 |
| CVE-2026-22803 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | HIGH | 0.60% | Jan 15, 2026 |
| CVE-2025-67647 | SvelteKit Denial of service and possible SSRF when using prerendering | HIGH | 0.53% | Jan 15, 2026 |
| CVE-2024-23641 | Sending a GET or HEAD request with a body crashes SvelteKit | HIGH | 0.76% | Jan 24, 2024 |
Showing 1 to 5 of 5 CVEs