Sveltejs / Kit
18 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-82261 | SvelteKit before 2.52.2 CPU Exhaustion via Remote Form Deserialization | HIGH | 8.7 | Aug 28, 2026 |
| CVE-2026-82260 | SvelteKit before 2.52.2 Memory Exhaustion via Remote Form Deserialization | HIGH | 8.7 | Aug 28, 2026 |
| CVE-2026-82259 | SvelteKit 2.49.0 before 2.53.3 Denial of Service via form | HIGH | 8.7 | Aug 28, 2026 |
| CVE-2026-82258 | SvelteKit 2.38.0 before 2.60.1 Cross-User Data Disclosure via query.batch | MEDIUM | 5.9 | Aug 28, 2026 |
| CVE-2026-82257 | SvelteKit before 2.69.1 Prototype Pollution via File Input | MEDIUM | 5.3 | Aug 28, 2026 |
| CVE-2026-82256 | SvelteKit before 2.69.1 Denial of Service via Remote Form | MEDIUM | 6.9 | Aug 28, 2026 |
| CVE-2026-66062 | SvelteKit: ReDoS (O(n^2)) in content negotiation — unauthenticated DoS via the Accept header | MEDIUM | 5.3 | Aug 7, 2026 |
| CVE-2026-40074 | SvelteKit's invalidated redirect in handle hook causes Denial-of-Service | MEDIUM | 6.3 | Apr 10, 2026 |
| CVE-2026-40073 | SvelteKit has a BODY_SIZE_LIMIT bypass in @sveltejs/adapter-node | HIGH | 8.2 | Apr 10, 2026 |
| CVE-2026-27118 | Cache poisoning in @sveltejs/adapter-vercel | MEDIUM | 5.3 | Feb 20, 2026 |
| CVE-2026-22803 | SvelteKit has a memory amplification DoS in Remote Functions binary form deserializer | HIGH | 8.2 | Jan 15, 2026 |
| CVE-2025-67647 | SvelteKit Denial of service and possible SSRF when using prerendering | HIGH | 8.4 | Jan 15, 2026 |
| CVE-2025-32388 | SvelteKit allows XSS via tracked search_params | MEDIUM | 5.4 | Apr 15, 2025 |
| CVE-2024-53261 | Cross-Site Scripting attack (XSS) on dev mode 404 page in SvelteKit | LOW | 2.0 | Nov 25, 2024 |
| CVE-2024-53262 | Unescaped error message included on error page in SvelteKit | LOW | 2.0 | Nov 25, 2024 |
| CVE-2024-23641 | Sending a GET or HEAD request with a body crashes SvelteKit | HIGH | 7.5 | Jan 24, 2024 |
| CVE-2023-29008 | SvelteKit framework has Insufficient CSRF protection for CORS requests | HIGH | 8.8 | Apr 6, 2023 |
| CVE-2023-29003 | SvelteKit has Insufficient Cross-Site Request Forgery Protection | HIGH | 8.8 | Apr 4, 2023 |
Showing 1 to 18 of 18 CVEs